Relational Database Service (MySQL)

Security White Paper

2024-06-21 09:38:11

RDS for MySQL is a new generation of high-performance enterprise-level relational databases developed by eSurfing Cloud. MySQL supports multiple architectures and has key database capabilities on the cloud such as high availability, high reliability, high security, scaling up/down, fast backup restoration, and monitoring. The complete performance monitoring system and multiple security protection measures, along with professional database management platform allow you to easily configure, operate, and expand relational databases.

To ensure the security of operation, data, and service operation and ensure safe and orderly operation of customer services, eSurfing Cloud prohibits operation and maintenance (O&M) personnel from deleting instances and backup data while deleting resources, accessing the database instances without written authorization from customers, and processing and transferring customer data.

To ensure the reliability and security of the tenant database, MySQL provides several functions, such as VPC, security groups, permission settings, SSL connections, automatic/manual backups, cross-AZ deployment, and point-in-time data restoration. These functions can help tenants better manage and protect their databases.

Network Isolation

The MySQL instances operate in a single VPC, which is not shared with other instances. After an instance is created, MySQL assigns the IP address of this subnet to the tenant for database connection. The MySQL instances operate in an independent VPC of the tenant, which improves the security of relational database instances.

Storage Isolation

The storage resources are allocated based on the tenant. The instances of each tenant are independent of the instances of others. The resources are isolated and do not affect each other.

Access Control

When a tenant creates a MySQL instance, a database master account is created synchronously for the tenant by default, which allows the tenant to operate the created MySQL instance database. The tenant can create users with other permissions based on their service requirements to separate permissions. When a tenant creates a MySQL instance, they can specify the inbound and outbound rules of the security group where the relational database instance resides through VPC, thus controlling the network scope that can connect to the database.

Transmission Encryption

MySQL instances support SSL-encrypted transmission of databases. The tenant can use the CA root certificate downloaded from the tenant console and provide the certificate when connecting to a database to authenticate the database server and achieve encrypted transmission.

Backup and Restoration

MySQL supports automatic and manual backups. Automatic backup is enabled by default. In the event of database fault or data damage, the database can be restored through backups. You can set the number of retained historical backups according to the size of the data amount and the backup space. Alternatively, you can manually create backups according to your needs. eSurfing Cloud supports real-time backup of binlog, which allows tenants to restore data by time point.

Instance Disaster Recovery

MySQL supports the high availability of clusters. When a tenant selects a primary or a standby instance, if a single node fails, MySQL will automatically route the service to other nodes, thereby achieving high availability.

Data Replication

MySQL allows you to deploy highly available primary/standby instances. When a tenant selects a primary or a standby instance, MySQL will automatically establish and maintain a synchronous replication of the database. If the primary instance fails, MySQL will automatically upgrade the standby instance to the primary instance, thus achieving high availability.

Data Deletion

When a tenant deletes a MySQL instance, the data stored in the database instance is also deleted. No one can view and restore the data.


NubViNh8Wwux