Authorize cloud vendor accounts

1. Create an OceanBase Cloud cross-account access user and delegate.

   Create a new delegate in the Huawei Cloud Identity and Access Management Service IAM > Delegation section. Note the following configurations:

   1. For Delegate Type, select Regular Account.

   2. For Delegated Account, enter the root account provided by OceanBase Cloud (automatically obtained for the current instance).

      Note

      The root account provided by OceanBase Cloud can be viewed in Security Settings > TDE > View Huawei Cloud Account Authorization.

2. Configure KMS access permissions.

   Note

   To configure for the first time, you need to create a permission policy with specified authorization. If a similar policy already exists, you can skip the first step.

   1. Create a custom policy.

      1. On the Identity and Access Management (IAM) management page, click Permission Management > Permissions in the left navigation bar.

      2. On the Permission Policy page, click Create Custom Policy in the upper-right corner.

      3. Enter a policy name, then on the Visual View tab, select the following configuration:

         

         Option	Description
         Effect	Allow
         Service	Data Encryption Service
         Operation	Select the following permissions: kms:cmk:get (Query key information) kms:cmk:list (Query key list) kms:dek:create (Create data key) kms:dek:encrypt (Encrypt data key) kms:dek:decrypt (Decrypt data key)
         Resource	All Resources is selected by default. If you only want to grant access to specific KMS resources for OceanBase, you can select Specific Resources.

      4. Click OK to complete the creation.

   2. Configure KMS key permissions for the grant.

      1. In the left navigation bar, click Grants.

      2. In the grant list, click Authorize in the Actions column of the target grant.

      3. On the authorization page, select the policy created in the first step and click Next.

      4. After setting the minimum authorization scope, click OK.

   3. Obtain the URN information in the IAM Grant Details.

3. Perform authorization verification.

   1. Log in to the OceanBase Cloud console.

   2. In the left navigation bar, click Cluster List, select the target cluster, and go to the Cluster Dashboard page.

   3. In the left navigation bar, click Security.

   4. On the Security Settings page, click the Transparent Data Encryption (TDE) tab.

   5. Click View Huawei Cloud Account Authorization.

   6. Enter the URN obtained from the IAM delegation details and click Complete.

      

1. Log in to the AWS IAM Management Console.

2. Configure KMS access permissions.

   Note

   To configure for the first time, you need to create a permission policy with specified authorization. If a similar policy already exists, you can skip the first step.

   1. Create a custom KMS permission policy.

      1. On the Policy Management page, click Creation Strategy.

      2. On the Visual Editing tab, select the following configuration:

         

         Option	Description
         Select Service	KMS
         Action	Select Specify Actions and choose the following permissions: ListAliases ListKeys DescribeKey GenerateDataKey Decrypt Encrypt
         Resources	All is selected by default. If you only want to allow OceanBase access to specific KMS resources, you can select Specify Resources.

      3. Click OK to complete the creation.

   2. Create an IAM role and configure KMS key permissions.

      1. On the Role Management page, click Create Role.

      2. Select Custom Trust Policy, then fill in the following configuration, and insert the IAM user ARN provided by OceanBase Cloud into the Principal field.

         Note

         The IAM user ARN can be viewed under Security Settings > TDE > View AWS Account Authorization.
         

         

         {
            "Version":"2012-10-17"
            "Statement":[
            {
               "Effect":"Allow",
               "Principal":{****},
               "Action":"sts:AssumeRole"
            }]
         }
         

      3. When adding permissions, select the custom permission policy created in Step 1.

         

      4. Enter the name and description, then click OK.

         

   3. Obtain the ARN information from the AWS IAM role details.

3. Authorization verification.

   1. Log in to the OceanBase Cloud console.

   2. In the left-side navigation pane, click Cluster List, select the target cluster, and go to the Cluster Workspace page.

   3. In the left-side navigation pane, click Security.

   4. On the Security Settings page, click the Transparent Data Encryption (TDE) tab.

   5. Click View AWS Account Authorization.

   6. Enter the ARN obtained from the AWS IAM role details into the ARN field, then click Complete.

      

Prerequisites

• You have enabled the KMS API service. To enable it, visit Cloud Key Management Service (KMS) API.

Procedure

1. Create a service account.

   1. Log in to GCP IAM and Admin > Service Accounts.

   2. Click Create Service Account.

   3. In the service account creation dialog box, enter the service account name and click Create and Continue.

   4. In the service account authorization step, authorize the following predefined GCP roles. For detailed role descriptions, see Permissions and roles.

      • Cloud KMS Viewer
      • Cloud KMS Crypto Operator
      • Cloud KMS CryptoKey Encrypter/Decrypter

      

   5. Click Complete.

2. Authorize permissions for the OB service account.

   1. Click the name of the newly created account to go to its management page.

   2. Click Principals with access.

   3. On the View by principals tab, click Grant access.

   4. On the authorization page that appears, enter the following information:

      • Add principals: Enter the complete information of the OB Cloud service account.

        Note

        The root account provided by OceanBase Cloud can be viewed under Security Settings > TDE > View Google Cloud Account Authorization.

      • Assign roles: Search for the token and select Service Account Token Creator.

      

   5. Click Save.

   6. After the role is created, obtain the email address from the service account details.

      

3. Authorize verification.

   1. Log in to the OceanBase Cloud console.

   2. In the left-side navigation pane, click Cluster List, select the target cluster, and go to the Cluster Dashboard page.

   3. In the left-side navigation pane, click Security.

   4. On the Security Settings page, click the Transparent Data Encryption (TDE) tab.

   5. Click View Google Cloud Account Authorization.

   6. Enter the email information obtained from the GCP service account details and click Complete.