DB & Server Access Control glossary

Available in VPC

Familiarize yourself with these key terms to get the most out of DB & Server Access Control.

Access Control Target

A resource registered in the console for access control and logging. Each target corresponds to a relay session within the proxy server that maps to a resource on a 1:1 basis. Targets are classified as server targets or database targets.

Access Port

The port number used by the proxy server when connecting to access control target resources.

Client

An agent program installed on the user's PC. When you log in with a sub account, the client retrieves and displays the list of targets you can access from the proxy server. It serves as an entry point that forwards your connection traffic to the proxy server.

DB Target

A target type for registering Cloud DB or DBMS Server as an access control target.

DBMS Server

A type of DB target for registering a database directly installed on a server or configured from a server image as an access control target.

Masking

A feature that masks personal information before the proxy server transfers results to the Cloud Log Analytics service. You can apply masking when the logging scope is set to Request & Response. It provides default patterns for items subject to encryption under the Personal Information Protection Act.

Proxy Server

A gateway server deployed when you subscribe to the DB & Server Access Control service. It relays connections between the user and the target resource, verifies access permissions, and transfers executed commands and queries to the Cloud Log Analytics service.

Server Target

A target type for registering a Linux server accessed through SSH as an access control target.

Bulk query

A query whose results meet or exceed the threshold defined in the Dashboard analytics criteria settings. The number of queries exceeding the threshold is aggregated in the Dashboard and utilized for detecting abnormal behavior, such as bulk retrieval of personal information.

Logging scope

Access history recording scope configured per target. Request records connection time, connected user, connected IP, queries, and commands, while Request & Response additionally records result values.

Non-business hours

Time periods outside the business hours range defined during proxy server creation or in the Dashboard analytics criteria settings.

Usage range

The range of server target counts you can create. Configure a usage range before creating server targets. Charges apply per range from the time it is configured, regardless of the number of targets actually created. Database targets have no usage range. You can create up to 30 database targets.

Policy synchronization

A feature that updates the target list by retrieving the latest access permission information from the proxy server via the client.

Closed network environment

An environment with no internet access that connects to a VPC through IPsec VPN. Sub account SSO login is unavailable in this environment. Log in to the client by entering your sub account's Access Key, Secret Key, and OTP.