Enterprise Service Platform - PolarDB - Alibaba Cloud Documentation Center

The PolarDB Agent Enterprise Service Platform is a web service deployed inside your virtual private cloud (VPC) that centrally creates and manages PolarDB Agent Express applications. The service lets you templatize the configuration of PolarDB Agent Express applications and integrate with enterprise applications such as Feishu, DingTalk, or WeCom to centrally authenticate and authorize team members. This topic walks you through the end-to-end procedure, from preparing the required credentials, creating an application instance, and configuring network access, to finally using the application.

Overview

The PolarDB Agent Enterprise Service Platform is essentially a privately managed platform deployed under your Alibaba Cloud account. It wraps the complex configuration procedure of PolarDB Agent Express applications in a graphical interface and addresses the following needs:

Simplified deployment: With preset templates, team members can create PolarDB Agent Express applications with one click, without needing to understand the underlying details.
Unified authentication: Integrates with the organizational structure of your enterprise application (such as Feishu, DingTalk, or WeCom) so that team members can sign in securely with their enterprise application accounts.
Access control: Administrators of the Enterprise Service Platform can centrally manage and maintain the configuration templates of PolarDB Agent Express applications.

Prerequisites

Before you create an application, prepare the following two credentials:

An AccessKey pair of a RAM user that has the required permissions.
A custom enterprise application that has been created and released on Feishu, DingTalk, or WeCom, along with its credentials.

Preparation 1: Obtain the AccessKey pair of a RAM user

The PolarDB Agent Enterprise Service Platform uses an AccessKey pair to call Alibaba Cloud APIs and manage resources. Follow the principle of least privilege and use a dedicated RAM user and AccessKey pair.

Create a custom policy.

Log on to the RAM console. In the left-side navigation pane, choose Permissions > Policies.
Click Create Policy, and then switch to the JSON tab.

Paste the following JSON policy into the policy editor and click OK.

Click to view the full JSON policy

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "polardb:DescribeDBClusters",
        "polardb:DescribeAIDBClusters",
        "polardb:DescribeDBClusterAttribute",
        "polardb:DescribeDBClusterEndpoints",
        "polardb:DescribeRegions",
        "polardb:DescribeHistoryEvents",
        "polardb:DescribePolarAgents",
        "polardb:DescribeApplications",
        "polardb:CreateApplication",
        "polardb:DeleteApplication",
        "polardb:DescribeApplicationAttribute",
        "polardb:OperateApplication",
        "polardb:UpgradeApplicationVersion",
        "polardb:DescribeApplicationParameters",
        "polardb:ModifyApplicationParameter",
        "polardb:ModifyApplicationDescription",
        "polardb:ModifyApplicationWhitelist",
        "polardb:CreateApplicationEndpointAddress",
        "polardb:DeleteApplicationEndpointAddress",
        "polardb:DescribePolarClawSkills",
        "polardb:ModifyPolarClawSkill",
        "polardb:DescribeApplicationPerformance",
        "polardb:DescribeApplicationBackupPolicy",
        "polardb:ModifyApplicationBackupPolicy",
        "polardb:DescribeApplicationBackups",
        "polardb:CreateApplicationBackup",
        "polardb:DeleteApplicationBackup",
        "polardb:RestoreApplicationByBackupSet",
        "polardb:DescribeApplicationPrompts",
        "polardb:CreateApplicationPrompt",
        "polardb:ModifyApplicationPrompt",
        "polardb:DeleteApplicationPrompt",
        "polardb:ApplyApplicationPrompts",
        "polardb:ModifyApplicationPromptStatus",
        "polardb:DescribeApplicationLogs",
        "polardb:DescribeApplicationSessionIds",
        "polardb:DescribeApplicationSessionLogs",
        "polardb:DescribePolarClawSkillsMarket",
        "polardb:DescribePolarClawSkillTemplates",
        "polardb:DescribePolarClawSkillTemplate",
        "polardb:DescribePolarClawSkillAssessment",
        "polardb:CreatePolarClawSkillTemplate",
        "polardb:DeletePolarClawSkillTemplate",
        "polardb:CreatePolarClawSkill",
        "polardb:GetPolarClawSkillRegion",
        "polardb:CheckPolarClawSkill",
        "polardb:DeletePolarClawSkill",
        "polardb:CreateBatchTask",
        "polardb:DescribeBatchTasks",
        "polardb:DescribeBatchTask",
        "polardb:DescribeGatewayList",
        "polardb:DescribeAIGatewayInstances",
        "polardb:DescribeAIGatewayAttribute",
        "polardb:ListAIGatewayModelApis",
        "polardb:GetAIGatewayModelApiCreationOptions",
        "polardb:CreateAIGatewayModelApi",
        "polardb:ModifyAIGatewayModelApi",
        "polardb:DeleteAIGatewayModelApi",
        "polardb:ListAIGatewayModelServices",
        "polardb:CreateAIGatewayModelService",
        "polardb:ListAIGatewayConsumerGroups",
        "polardb:CreateAIGatewayConsumerGroup",
        "polardb:DeleteAIGatewayConsumerGroup",
        "polardb:ModifyAIGatewayConsumerGroup",
        "polardb:ListAIGatewayConsumers",
        "polardb:DescribeAIGatewayConsumer",
        "polardb:CreateAIGatewayConsumer",
        "polardb:ResetAIGatewayConsumerApiKey",
        "polardb:DeleteAIGatewayConsumer",
        "polardb:ListAIGatewayRateLimitPolicies",
        "polardb:CreateAIGatewayRateLimitPolicy",
        "polardb:DeleteAIGatewayRateLimitPolicy",
        "polardb:ModifyAIGatewayRateLimitPolicy",
        "polardb:ListAIGatewayBudgetPolicies",
        "polardb:CreateAIGatewayBudgetPolicy",
        "polardb:DeleteAIGatewayBudgetPolicy",
        "polardb:ModifyAIGatewayBudgetPolicy",
        "polardb:DescribeGatewayAttribute",
        "polardb:DescribeBudgetStats",
        "polardb:DescribeCostRules",
        "polardb:CreateCostRule",
        "polardb:ModifyCostRule",
        "polardb:DeleteCostRule",
        "polardb:StartAIGateway",
        "polardb:StopAIGateway",
        "polardb:RestartAIGateway",
        "polardb:ReleaseAIGateway",
        "polardb:CreateAIGatewayPublicEndpoint",
        "polardb:DescribeAIGatewaySecurityGroups",
        "polardb:DescribeAIGatewayIPArrayList",
        "polardb:ModifyAIGatewaySecurityIPs",
        "polardb:DescribeAIGatewayPerformance",
        "polardb:ListAIGatewayEvents",
        "polardb:ListTagResourcesForRegion",
        "polardb:TagResources",
        "polardb:UntagResources",
        "polardb:DescribeModelServices",
        "polardb:DescribeModelApis",
        "polardb:DescribeConsumerGroups",
        "polardb:DescribeRateLimitPolicy"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeSecurityGroups"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "tag:ListTagKeys",
        "tag:ListTagValues"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "oss:PutBucketPolicy",
        "oss:GetBucketPolicy",
        "oss:PutObject"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "bss:Refund*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "bss:Renew*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "bss:ModifyInstance"
      ],
      "Resource": "*"
    }
  ]
}

Enter a name for the policy (for example, PolarDB Agent ExpressSaaSMinimalAccess) and complete the creation.

Create a RAM user and grant permissions.
1. In the left-side navigation pane, choose Identities > Users, and then select or create a RAM user.
  1. Select an existing user: Go to the user details page, and on the AccessKey tab, use an existing AccessKey pair or create a new one. To create a new AccessKey pair, select For local development and securely save the generated AccessKey ID and AccessKey Secret.
  2. Create a new user: On the Create User page, fill in the basic information and select Use permanent AccessKey to access. After the user is created, save the AccessKey ID and AccessKey Secret of the RAM user.
2. On the user details page, switch to the Permissions tab and click Grant Permission. Attach the PolarDB Agent ExpressSaaSMinimalAccess policy that you created in the previous step to the user.

Preparation 2: Obtain the enterprise application credentials (App ID and App Secret)

The PolarDB Agent Enterprise Service Platform uses a custom enterprise application (such as Feishu, DingTalk, or WeCom) to authenticate users.

DingTalk

Create a DingTalk app:
1. Go to the DingTalk Open Platform and click App Development in the top navigation bar. In the left-side navigation pane of App Development, choose Internal Apps > DingTalk Apps, and then click Create App in the upper-right corner.
2. In the Create App panel, fill in the app name, app description, and app icon (optional), and then click Save to complete the creation.
Add the required permissions: In the left-side navigation pane, choose Development > Permission Management, and add the Read user profile (Contact.User.Read) permission.
Release the DingTalk app: After the app is created, you must release a version to allow other users in your enterprise to use it.
1. In the left-side navigation pane, choose App Release > Version Management and Release, and click Create new version.
2. On the version details page, enter the app version number and release notes, select an appropriate visibility scope, and then click Save. In the dialog box that appears, click Confirm Release.
After the app is released, go to the Credentials and Basic Information page and record the Client ID and Client Secret. You will need these credentials later when you configure the PolarDB Agent Enterprise Service Platform.

Feishu

Sign in to the Feishu Open Platform and click Developer Console in the upper-right corner. In the console, click Create Custom App, enter the App Name, App Description, and App Icon, and then click Create.
In the left-side navigation pane, click Permission Management, and then click Add Permissions.

Search for and select the following permissions. Click Confirm, and then click Confirm again in the confirmation dialog box.

Important

After you add permissions, you must click Confirm to save your changes. Otherwise, the permissions do not take effect.

Permission ID	Description
`contact:user.employee:readonly`	Read a user's employee information.
`contact:user.phone:readonly`	Read a user's phone number.
`contact:user.base:readonly`	Read a user's basic profile.
`contact:user.email:readonly`	Read a user's email address.

After you complete the configuration, release the app to apply the changes. In the left-side navigation pane, click Version Management and Release, and then click Create new version in the upper-right corner.
Set the Availability to All employees, enter the version number and release notes, and then click Save and Confirm Release at the bottom of the page.
After the app is released, go to the Credentials and Basic Information page and record the App ID and App Secret. You will need these credentials later when you configure the PolarDB Agent Enterprise Service Platform.

WeCom

Create a WeCom app:
1. Log on to the WeCom admin console. In the left-side navigation pane, choose App Management > Custom, and then click Create App.
2. Enter the app name, app logo, and visibility scope, and then click Create App.
Obtain the app credentials:
- Obtain the Agent ID and Secret: Open the app that you just created. On the app details page, obtain the AgentId and Secret.
- Obtain the Corp ID: In the left-side navigation pane, choose My Enterprise. On the enterprise information page, obtain the Enterprise ID (Corp ID).
Record the Corp ID, Agent ID, and Secret. You will need these credentials later when you configure the PolarDB Agent Enterprise Service Platform.

Procedure

After you complete all preparations, perform the following steps to create and configure the application.

Step 1: Create a PolarDB Agent Enterprise Service Platform

Log on to the PolarDB console. In the left-side navigation pane, click PolarDB AI > PolarDB Agent Express. In the top navigation bar, switch to the destination region.
On the PolarDB Agent Express page, switch to the Enterprise Service Platform tab and click Create Now.
On the creation page, configure the following core parameters:
- Alibaba Cloud Account AccessKey: Enter the AccessKey ID and AccessKey Secret that you obtained in Prerequisites.
- VPC Network and Zone and vSwitch: Select the VPC and vSwitch in which the PolarDB Agent Enterprise Service Platform is to be deployed.
- Security Group: Select a security group and make sure that its inbound rules allow access to port 8080.
- SaaS Login Method: For Application Type, select Lark, DingTalk, or WeCom, and enter the corresponding enterprise application credentials that you obtained in Prerequisites.
Click OK to start the creation.

Step 2: Configure network access

After the PolarDB Agent Enterprise Service Platform is created, it can be accessed only over the VPC by default. To allow the PolarDB Agent Enterprise Service Platform to communicate with the authentication services of Feishu, DingTalk, or WeCom over the Internet and to be accessed over the Internet, configure the network as follows.

Create an Internet NAT gateway: Go to the Internet NAT Gateway buy page. During creation, make sure that you select the same VPC and vSwitch as the PolarDB Agent Enterprise Service Platform.
Configure an SNAT entry: Go to the Internet NAT Gateway page. Click Configure SNAT in the Actions column of the destination gateway, and then click Create SNAT Entry. Configure the parameters as follows:
- SNAT Entry: Select VPC.
- Select EIP: From the drop-down list, select an EIP that provides Internet access.
Note
Enabling Internet access incurs additional fees for the Internet NAT gateway and Internet traffic. For more information about the fees, see NAT Gateway billing.
(Optional) Apply for a public endpoint.
If you want to access the management application over the Internet, return to the PolarDB Agent Enterprise Service Platform details page in the PolarDB console and click Enable Public Endpoint to apply for a public endpoint.

Step 3: Configure the redirect URL of the enterprise application

DingTalk

Obtain the redirect URL.
On the details page of the PolarDB Agent Enterprise Service Platform, in the PolarDB Agent Enterprise Service Platform Usage Flow > Application Security Settings area, copy the DingTalk redirect URL generated by the system.
Configure DingTalk security settings.
Return to the DingTalk Open Platform and open your custom app. On the Security Settings page, add the copied redirect URL to Redirect URL (Callback Domain).

Feishu

Obtain the redirect URL.
On the details page of the PolarDB Agent Enterprise Service Platform, in the PolarDB Agent Enterprise Service Platform Usage Flow > Application Security Settings area, copy the Feishu redirect URL generated by the system.
Configure Feishu security settings.
Return to the Feishu Open Platform and open your custom app. On the Security Settings page, add the copied redirect URL to Redirect URL, and add the IP address contained in the redirect URL to IP Whitelist.

WeCom

Set the trusted domain.
Log on to the WeCom admin console and open your custom app. In the Developer Interfaces > Web Authorization and JS-SDK area, set the trusted domain. The domain must be bound to the public endpoint of the Enterprise Service Platform.

Note
When you set the trusted domain, you must download the verification file and deploy it to the root path of the server that corresponds to the domain. After you confirm that the verification file is accessible over the Internet, submit the verification. To obtain the public endpoint of the Enterprise Service Platform, submit a ticket to contact us.
Configure trusted enterprise IP addresses.
On the app details page, in the Developer Interfaces > Trusted Enterprise IP area, add the public outbound IP addresses of the Enterprise Service Platform. To obtain the IP addresses, submit a ticket to contact us.

Step 4: Access and use the Enterprise Service Platform

Configure the IP whitelist for access.
In the whitelist settings of the PolarDB Agent Enterprise Service Platform, add the IP addresses of clients that are allowed to access the application.
- For access over the Internet, add the public outbound IP address of your local network.
- For access over the internal network, add the IP addresses of clients in your VPC.
Access the application.
On the details page of the PolarDB Agent Enterprise Service Platform, find the internal endpoint or the public endpoint that you applied for, and access it in a browser.
Sign in and create a PolarDB Agent Express template.
The first user that signs in is automatically granted administrator permissions. On the Account Management page, you can create configuration templates for the PolarDB Agent Express application (Crayfish module). For example, set the model source to Bailian and enter the corresponding ModelFrom and ModelApiKey.
Team members create PolarDB Agent Express applications.
After the template is configured, other team members can sign in to the Enterprise Service Platform and go to the PolarDB Agent Express Management page to create their own PolarDB Agent Express applications with one click by selecting a template.