Security assessment
This topic describes the database security check items for clusters and tenants. You can enable secure configurations as needed.
Background information
ApsaraDB OceanBase performs security checks on clusters and tenants. These checks provide guidance on security configurations to help you ensure the overall security of your database.
Type | Check item | Description |
Cluster | Check if the whitelist range is too broad | If an IP address in the cluster whitelist is set to 0.0.0.0 or 0.0.0.0/0, it allows access from all IP addresses and is considered a security risk. |
Check if link encryption is enabled | Checks whether Secure Sockets Layer (SSL) link encryption is enabled for the cluster. This is not a security risk if disabled, but you can enable it for security hardening. After this feature is enabled, it cannot be disabled. | |
Check if the link encryption certificate has expired | If an SSL certificate will expire in less than 7 days, a security risk alert is triggered. This alert reminds you to update the certificate validity period. | |
Check if the geo-redundancy feature is enabled | Checks whether the geo-redundancy feature is enabled for the cluster. This is not a security risk if disabled, but you can enable it for security hardening as needed. | |
Check if the SQL diagnostics feature is enabled | Checks whether the SQL diagnostics feature is enabled for the cluster. This is not a security risk if disabled, but you can enable it for security hardening as needed. | |
Tenant | Check if the whitelist range is too broad | If an IP address in the tenant whitelist is set to 0.0.0.0 or 0.0.0.0/0, it allows access from all IP addresses and is considered a security risk. |
Check if the transparent encryption feature is enabled | Checks whether the transparent encryption feature is enabled for the tenant. This is not a security risk if disabled, but you can enable it for security hardening as needed. After this feature is enabled, it cannot be disabled. |
Procedure
In the navigation pane on the left, click Instance List, and then select the target cluster instance to go to the Cluster Instance Workbench page.
In the navigation pane on the left, click Security Settings.
Click the Security Assessment tab. You can view statistics for Total Check Items, Cluster Security Risk Items, and Tenant Security Risk Items.
Click View Security Assessment History to open the Security Center of the autonomy service.
Click the Cluster Check Items tab to view the status of each cluster check item. For items with a Security Risk status, review the suggestions and click Go to Handle to navigate to the corresponding configuration page.
Click the Tenant Check Items tab to view the status of each tenant check item. For items with a "High-risk" status, review the assessment recommendations and click Go To Fix to navigate to the corresponding configuration page.