Available in VPC
With NAVER Cloud Platform's DB & Server Access Control, you can easily and conveniently manage access permissions for servers and databases, log task history, and conduct audits. While you can explore the service in detail with Getting Started with DB & Server Access Control and Using DB & Server Access Control, we recommend starting with this quickstart overview to understand the complete workflow. Understanding the workflow before reviewing the detailed instructions helps you use DB & Server Access Control more effectively. Here's the entire process for using DB & Server Access Control:
1. Set user permissions
2. Subscribe and configure a proxy server
3. Register access control targets
4. Set access permissions
5. Install the client and access resources
6. Monitor and audit task history
7. Unsubscribe from the service
The DB & Server Access Control workflow covers environment configuration by administrators, resource access by users, and task history auditing. For details about the service architecture, how it works, and terminology, see DB & Server Access Control concepts.
1. Set user permissions
Set permissions to use the DB & Server Access Control service. Define DB & Server Access Control permissions by assigning policies to sub accounts created in NAVER Cloud Platform's Sub Account service. First, create a sub account in Sub Account in addition to your main account.
Sub Account is a free service with no additional charges. For more information about Sub Account and pricing, see Services > Management & Governance > Sub Account on the NAVER Cloud Platform portal.
The DB & Server Access Control service does not have a separate permission system, and console usage and resource access permissions are managed together through Sub Account. Permissions can be set using predefined system-managed (System Managed) policies and user-defined (User Created) policies, which you define by selecting the permissions yourself. To use the DB & Server Access Control service safely, it is recommended that you configure and manage the minimum number of permissions required to use the service. For detailed instructions, see:
2. Subscribe and configure a proxy server
When you subscribe to DB & Server Access Control, a proxy server is created in your VPC to relay connections and log task history. During the subscription stage, select the VPC and Subnet for deploying the proxy server, as well as the server specifications suitable for the scale of the access control targets, and set the dashboard analytics criteria (business hours, bulk query criteria).
Since the DB & Server Access Control service features access history logging as its core function, you must first subscribe to the Cloud Log Analytics service.
For detailed instructions, see:
3. Register access control targets
Register resources subject to access control and logging as server targets or DB targets. Before creating server targets, configure the usage range. For each target, you can configure the logging scope (Request or Request + Response) and personal information masking. For detailed instructions, see:
4. Set access permissions
User-specific resource access permissions are managed through user-defined policies in Sub Account. Define access permissions for specific server or database targets in policies and assign them to sub accounts or groups. When a user logs in, the proxy server checks these policies to allow or deny access. For detailed instructions, see:
5. Install the client and access resources
Download the dedicated client (Windows or macOS) from the user guide, install it on your PC, and log in with a sub account. Using an access tool (terminal, DB client, etc.) after logging in allows you to connect to an authorized server or DB via the proxy server. For detailed instructions, see:
6. Monitor and audit task history
On the console dashboard, you can view analytics on anomalies, such as access blocking status, non-business hour access, and bulk query activity. Detailed logs, such as commands, queries, and results executed by users, can be viewed and audited in the Cloud Log Analytics service. If long-term retention is required, you can store data in a bucket using the Object Storage service. For detailed instructions, see:
7. Unsubscribe from the service
To stop using the service, delete any registered access control targets and then cancel your subscription. When you unsubscribe, the proxy server created in your VPC is automatically deleted. Deleting the proxy server may forcibly terminate ongoing connections and task sessions. For detailed instructions, see: