The secure access proxy routes database connections through DMS instead of exposing your database endpoint directly. After you enable it, authorized users connect to a proxy-generated address using standard MySQL or HTTPS protocols — from the command line, a database client, or application code.
How it works
The proxy sits between your users and the database instance. When a user connects through the proxy address, DMS applies the security rules, data permissions, and sensitive column configurations already defined in your DMS environment. Access control, data masking, and operation auditing happen automatically at the proxy layer — no changes required in the database itself.
Prerequisites
Before you begin, ensure that you have:
DMS deployed in the Singapore or Indonesia (Jakarta) region. To switch regions, see Switch DMS deployment regions
The database instance and DMS in the same region
NoteTo check an instance's region, hover over it in the instance list on the left side of the DMS homepage.
A supported database type:
MySQL: RDS MySQL, PolarDB for MySQL, MyBase MySQL, PolarDB Distributed Edition, AnalyticDB for MySQL, or self-managed MySQL databases
MariaDB: RDS MariaDB or self-managed MariaDB databases
Your system role set to Administrator or DBA. To check your role, see View my system role
Enable the secure access proxy
Log on to the DMS console V5.0.
In the instance list on the left, right-click the target instance and select Secure Access Proxy.
NoteIn simple mode, click Database Instances in the navigation pane on the left. Right-click the target instance in the list, then click Secure Access Proxy.
On the secure access proxy details page, click Enable Secure Access Proxy.
In the Enable Secure Access Proxy dialog box, enter the Database Account and Database Password, then click Next.
In the Secure Access Proxy - Authorization dialog box, configure Authorized Personnel, Use Independent Database Account, and Configure Security Policy. For detailed guidance on authorization settings, see Grant secure access proxy permissions.
Click Confirm.
What's next
After enabling the proxy, connect to the instance using the proxy address:
To manage the proxy after enabling it:
Disable the proxy: Click Disable Secure Access Proxy in the upper-left corner of the secure access proxy details page.
Enable an Internet address: To connect from a local application or an application in a different Virtual Private Cloud (VPC), click Enable to the right of Internet Address.
Change the database account: Click the edit icon next to Database Account to update the account the proxy uses.
API reference
Use the following API operations to manage secure access proxies programmatically: