Docs

Database Workshop

Instance list

Enabling security control

Database Workshop (DBW) supports unified management of database instances, enabling database changes to follow a ticket approval workflow. This simplifies and standardizes database management while improving data management workflows. Before initiating the approval workflow for database instance changes, security control must be enabled for the instance. This topic explains how to enable security control for an instance.

Prerequisites

An instance and an account for RDS for SQL Server have been created. For detailed steps, refer to Creating an instance and Creating an account.

A user has been added as an administrator of DBW. For detailed steps, refer to Adding a user. Alternatively, to apply for DBW administrator privileges, refer to Role permission application.

Precautions

After enabling security control, the following operations are supported:

On the User management page, grant specified users permissions to enable security control for instances. For detailed steps, refer to Granting user permissions.

Access instances with security control enabled via password-free login in the data interaction platform. For detailed steps, refer to Logging on to the data interaction platform (RDS for SQL Server).

Manage instances with security control enabled through security rule sets. For details, refer to Security rule set management.

Only the primary account or sub-users added as DBW administrators can enable security control for instances. Once security control is enabled for an instance, administrators are automatically granted permissions for the current instance, including SQL changes, SQL queries, structural changes, operation and maintenance read-only and read/write operations for 1 year.

If the approval workflow for an instance is modified, existing approvals will still follow the previous process, while only newly generated approvals will adopt the updated workflow.

If you modify the account password of an instance, you must reset the password for the security-controlled instance. Otherwise, the system will fail to retrieve database information.

Enable instance security control

Log on to the DBW console.

On the top menu bar, select the project and region.

On the left navigation bar, click Instance list.

In the top-left corner of the Instance list page, switch the instance type to RDS for SQL Server.

Enable security control for the specified instance

Click the pen icon under the Security control column of the target instance.

In the Set security control dialog box, configure the following parameters.

Parameter	Description
Security control mode	Enable security control mode.
Security rule set	Select a security rule from the drop-down list. Fuzzy search is supported. tip For more information on security rule sets, refer to Security rule set management.
Instance DBA	Select the instance DBA from the drop-down list. Both administrator and normal user can be assigned as the instance DBA. The instance DBA will have full read and write permissions for the database instance. When the approval workflow is set to the system default template, the instance DBA will automatically serve as the second-level approver.
Instance Owner	Select the instance Owner from the drop-down list. Both administrator and normal user can be assigned as the instance Owner. The instance Owner will have full read and write permissions for the database instance. When the approval workflow is set to the system default template, the instance Owner will automatically serve as the first-level approver.
Approval workflow	Select the target approval workflow from the drop-down list. tip The primary account can approve all tickets by default. For more information on the approval workflow, refer to Approval workflow management.
Database account	Enter the database account of the instance.
Database password	Enter the password for the instance database account. tip If you change the database account password for an instance, you must update the corresponding password to the new value on the instance list page within the DBW console.

Click Test connectivity to verify whether the instance is successfully connected.

Click OK.

Batch enable instance security control

All target instances for batch security control enablement must be disabled.

Select the target instance, and choose Batch security control > Batch enable on the bottom menu bar.

In the Enable security control panel, configure the following parameters.

Parameter	Description
Security rule set	Select a security rule from the drop-down list. Fuzzy search is supported. tip Click Batch next to the Security rule set column to set the security rule set to all selected instances. Once successfully configured, the instances will share the same security rule set. For more information on security rule sets, refer to Security rule set management.
Approval workflow	Select the target approval workflow from the drop-down list. tip Click Batch next to the Approval workflow column to set the approval workflow to all selected instances. Once successfully configured, the instances will share the same approval workflow. The primary account can approve all tickets by default. For more information on the approval workflow, refer to Approval workflow management.
Instance DBA	Select the instance DBA from the drop-down list. Both administrator and normal user can be assigned as the instance DBA. The instance DBA will have full read and write permissions for the database instance. tip When the approval workflow is set to the system default template, the instance DBA will automatically serve as the second-level approver. Click Batch next to the Instance DBA column to assign the instance DBA to all selected instances. Once successfully configured, the instances will share the same instance DBA.
Instance Owner	Select the instance Owner from the drop-down list. Both administrator and normal user can be assigned as the instance Owner. The instance Owner will have full read and write permissions for the database instance. tip When the approval workflow is set to the system default template, the instance Owner will automatically serve as the first-level approver. Click Batch next to the Instance Owner column to assign the instance Owner to all selected instances. Once successfully configured, the instances will share the same instance Owner.
Database account	Enter the database account of the instance. tip Click Batch next to the Database account column to assign the database account to all selected instances. If batch configuration is required, the database account must be identical for all instances.
Database password	Enter the password for the instance database account. tip Click Batch next to the Database password column to set the database password to all selected instances. If batch configuration is required, the database password must be identical for all instances. If you change the database account password for an instance, you must update the corresponding password to the new value on the instance list page within the DBW console.

Click One-click connectivity test to verify whether the instance is successfully connected.

Click OK.

After enabling security control, you can view the security control status of the target instance as enabled on the instance list page.

Modify instance security control

Log on to the DBW console.

On the top menu bar, select the project and region.

On the left navigation bar, click Instance list.

In the top-left corner of the Instance list page, switch the instance type to RDS for SQL Server.

Modify security control for the specified instance

Click the pen icon under the Security control column of the target instance.

In the Set security control dialog box, configure the following parameters.

Parameter	Description
Security control mode	Enable security control mode.
Security rule set	Select a security rule from the drop-down list. Fuzzy search is supported. tip For more information on security rule sets, refer to Security rule set management.
Instance DBA	Select the instance DBA from the drop-down list. Both administrator and normal user can be assigned as the instance DBA. The instance DBA will have full read and write permissions for the database instance. When the approval workflow is set to the system default template, the instance DBA will automatically serve as the second-level approver.
Instance Owner	Select the instance Owner from the drop-down list. Both administrator and normal user can be assigned as the instance Owner. The instance Owner will have full read and write permissions for the database instance. When the approval workflow is set to the system default template, the instance Owner will automatically serve as the first-level approver.
Approval workflow	Select the target approval workflow from the drop-down list. tip The primary account can approve all tickets by default. For more information on the approval workflow, refer to Approval workflow management.
Database account	Enter the database account of the instance.
Database password	Enter the password for the instance database account. tip If you change the database account password for an instance, you must update the corresponding password to the new value on the instance list page within the DBW console.

Click Test connectivity to verify whether the instance is successfully connected.

Click OK.

Batch modify instance security control

All target instances for batch security control editing must be enabled.

Select the target instance, and choose Batch security control > Batch edit on the bottom menu bar.

In the Enable security control panel, configure the following parameters.

You can optionally configure Security rule set, Approval workflow, and Instance DBA and Owner, Database account and password as needed.

Parameter	Description
Security rule set	Select a security rule from the drop-down list. Fuzzy search is supported. tip Click Batch next to the Security rule set column to set the security rule set to all selected instances. Once successfully configured, the instances will share the same security rule set. For more information on security rule sets, refer to Security rule set management.
Approval workflow	Select the target approval workflow from the drop-down list. tip Click Batch next to the Approval workflow column to set the approval workflow to all selected instances. Once successfully configured, the instances will share the same approval workflow. The primary account can approve all tickets by default. For more information on the approval workflow, refer to Approval workflow management.
Instance DBA	Select the instance DBA from the drop-down list. Both administrator and normal user can be assigned as the instance DBA. The instance DBA will have full read and write permissions for the database instance. tip When the approval workflow is set to the system default template, the instance DBA will automatically serve as the second-level approver. Click Batch next to the Instance DBA column to assign the instance DBA to all selected instances. Once successfully configured, the instances will share the same instance DBA.
Instance Owner	Select the instance Owner from the drop-down list. Both administrator and normal user can be assigned as the instance Owner. The instance Owner will have full read and write permissions for the database instance. tip When the approval workflow is set to the system default template, the instance Owner will automatically serve as the first-level approver. Click Batch next to the Instance Owner column to assign the instance Owner to all selected instances. Once successfully configured, the instances will share the same instance Owner.
Database account	Enter the database account of the instance. tip Click Batch next to the Database account column to assign the database account to all selected instances. If batch configuration is required, the database account must be identical for all instances.
Database password	Enter the password for the instance database account. tip Click Batch next to the Database password column to set the database password to all selected instances. If batch configuration is required, the database password must be identical for all instances. If you change the database account password for an instance, you must update the corresponding password to the new value on the instance list page within the DBW console.

Click One-click connectivity test to verify whether the instance is successfully connected.

Click OK.

Disable instance security control

warning

When disabling security control, ensure that there are no tickets in the current instance with statuses such as not started, pre-checking, approving, waiting for execution, or executing. If any such tickets exist, manually complete them before disabling security control.

Log on to the DBW console.

On the top menu bar, select the project and region.

On the left navigation bar, click Instance list.

In the top-left corner of the Instance list page, switch the instance type to RDS for SQL Server.

Disable security control for the specified instance

Click the pen icon under the Security control column of the target instance.

In the Set security control dialog box, disable the security control mode.

Batch disable instance security control

All target instances for batch security control disablement must be enabled.

Select the target instance, and choose Batch security control > Batch disable on the bottom menu bar.

In theBatch disable security control dialog box, click OK.

Last updated: 2025.10.11 11:04:58