Data Management (DMS) lets you define custom approval chains for database permission applications. By default, only a database administrator (DBA) needs to approve a request. You can change this — for example, requiring both the database owner and a DBA to approve access to production databases, or blocking regular users from requesting query permissions on production databases entirely.
This topic walks through a complete example: an administrator configures a two-approver process for the poc_prod production database, then a regular user submits a permission request to confirm the process is in effect.
Prerequisites
Before you begin, ensure that you have:
A DMS administrator account
A security rule set already applied to the target database (this example uses
Security Rules for POC Production Databasesapplied topoc_prod)
Configure the approval process (administrator)
Log on to the DMS console V5.0 as a DMS administrator.
Go to the Security Rules page:
Move the pointer over the
icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Security Rules.
NoteIn normal mode, choose Security and disaster recovery (DBS) > Security Rules in the top navigation bar.
Find the
Security Rules for POC Production Databasessecurity rule set and click Edit in the Actions column.On the Details page, click the Access apply tab.
Find the [DB-permission application] default approval Template rule and click Edit in the Actions column.
In the dialog box, click Switch Approval Template. The default template requires only DBA approval. Switching the template lets you add additional required approvers.
Find the
Owner-->DBAtemplate and click Select in the Actions column.Click Submit.
The security rule set is updated. All new permission requests for databases governed by Security Rules for POC Production Databases now require approval from both the instance owner and the DBA.
Verify the approval process (regular user)
Log on as a regular user to confirm the customized approval process is in effect.
Log on to the DMS console V5.0 as a regular user.
Go to the Permission Tickets page:
Move the pointer over the
icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Permission Center > Permission Tickets.
NoteIn normal mode, choose Security and disaster recovery (DBS) > Permission Center > Permission Tickets in the top navigation bar.
In the upper-right corner, choose Access apply > Database-Permission.
On the Security Hosting Enabled tab, click the Database Permission tab. In the Select Databases/Tables/Columns section, enter
poc_prodand click Search.Select
poc_prodfrom the results and click Add to move it to the Selected Databases/Tables/Columns section.In the Select Permission section, configure the Permission, Duration, and Reason fields, then click Submit. The ticket is submitted and is now pending approval from the instance owner and the DBA. Track the status on the console homepage.
After the ticket is approved, find the ticket and click Details in the Actions column. On the Ticket Details page, click View Approval Details in the Approval section to see the full approval chain and the status of each approver.