EPAS (DBaaS) server connection

Scenario Overview

The EPAS(DBaaS) server connection scenario creates a Bastion host (Virtual Server) and a Database service, and accesses the DB service through the Bastion host. To connect to EPAS (DBaaS) stably in the Samsung Cloud Platform environment, you need to create a bastion host and use it to establish a network connection. To maintain a stable and highly secure environment, we recommend configuring the Database service in a private subnet and the bastion host in a restricted public subnet.

This scenario describes the process of creating a Bastion host and a Database service, configuring the network environment for connecting the Bastion host to the Database, and then connecting to the database using a DB client.

Scenario Components

You can configure the scenario using the following services.

How to Configure Scenarios

Create the services required to build a scenario by following the steps below.

1. Configure the network

This section describes the process of configuring the network environment for connecting to the Bastion Host and Database services.

1-1. Create a VPC

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Create VPC button. 2. Go to the Create VPC page.
3. On the Create VPC page, enter the information required to create the service.
   • Enter the IP range as 192.168.x.0/16.
4. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resources on the VPC List page.

1-2. Create a Subnet

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Subnet menu. 2. Go to the Subnet List page.
3. Click the Create Subnet button. 3. Go to the Create Subnet page.
4. On the Create Subnet page, enter the information required to create the service.
   • Select General as the subnet type.
   • Select a pre-created VPC.
   • Enter the IP range as 192.168.x.0/24.
5. Review the details and estimated billing amount generated in the Summary panel, and click the Complete button.
   • After creation is complete, verify the created resource on the Subnet List page.

1-3. Create an Internet Gateway

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Internet Gateway menu. 2. Go to the Internet Gateway List page.
3. Click the Create Internet Gateway button. 3. Navigate to the Create Internet Gateway page.
4. On the Create Internet Gateway page, enter the required information needed to create the service.
   • Select a pre-created VPC.
   • Select Use in the Firewall usage field.
5. Review the details and estimated billing amount generated in the Summary panel, and click the Complete button.
   • After creation is complete, verify the created resource on the Internet Gateway List page.

1-4. Create a Public IP

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Public IP menu. 2. Navigates to the Public IP List page.
3. Click the Reserve Public IP button. 3. Go to the Public IP Reservation page.
4. On the Public IP Reservation page, enter the required information for the service reservation.
5. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the Public IP List page.

1-5. Create a Security Group

1. Click the All Services > Networking > Security Group menu. 1. Go to the Service Home page of the Security Group.
2. On the Service Home page, click the Create Security Group button. 2. Navigate to the Create Security Group page.
3. On the Create Security Group page, enter the required information needed to create the service.
4. Review the input information and click the Complete button.
   • After creation is complete, verify the created resource on the Security Group List page.

2. Create a Bastion Host

This section describes the process of configuring a Bastion Host on which the database connection client must be installed.

2-1. Create a Server Keypair

1. Click the All Services > Compute > Virtual Server menu. 1. Go to the Service Home page of the Virtual Server.
2. On the Service Home page, click the Keypair menu. 2. Go to the Keypair List page.
3. Click the Create Keypair button. 3. Navigate to the Create Keypair page.
4. On the Create Keypair page, enter the required information needed to create the service.
5. Review the generation information and click the Complete button.
   • You can download the key only once. Reissuance is not available.
   • Be sure to store the downloaded key in a secure location.

2-2. Create a Bastion Host

1. Click the All Services > Compute > Virtual Server menu. 1. Go to the Service Home page of the Virtual Server.
2. On the Service Home page, click the Create Virtual Server button. 2. Go to the Create Virtual Server page.
3. Enter the required information to create a service on the Create Virtual Server page.
   • Select Windows for the image.
   • Select the pre-created VPC and Subnet.
   • Click Use NAT and select the Public IP reserved in 1-4. Create a Public IP.
   • Connect the Keypair created in 2-1. Create a Server Keypair.
4. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the Virtual Server List page.

2-3. Check the Bastion host login ID and password

1. Click the All Services > Compute > Virtual Server menu. 1. Go to the Service Home page of the Virtual Server.
2. On the Service Home page, click the Virtual Server menu. 2. Go to the Virtual Server List page.
3. On the Virtual Server List page, click the resource created in 2-2. Create a Bastion Host. 3. Navigates to the detailed information page for the specified resource.
4. On the details page, click the RDP password lookup button in the Keypair name field. 4. The RDP password lookup popup window opens.
5. In the RDP password lookup popup, attach the keypair file downloaded from 2-1. Create server Keypair.
6. After attaching, click the Password 확인 button. 6. The ID and password for accessing the resource are displayed.
   • The ID and password are used to connect to the Bastion host, as described in 5-1. Connecting to the Bastion host.

3. Creating a Database

This section describes the process of creating a Database service.

3-1. Create an EPAS (DBaaS) Service

1. Click the All Services > Database > EPAS(DBaaS) menu. 1. Go to the Service Home page of EPAS (DBaaS).
2. On the Service Home page, click the Create EPAS(DBaaS) button. 2. Go to the Create EPAS (DBaaS) page.
3. On the Create EPAS (DBaaS) page, enter the required information needed to create the service.
   • Select the pre-created VPC and subnets to connect.
   • Enter the Database-related creation information on the required information input screen.
   • Add the Bastion host IP to the IP access control entry.
   • The default database port is 2866, but you can specify a different port.
4. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After generation is complete, verify the created resource on the EPAS(DBaaS) list page.

4. Configure Rules

This section describes how to configure the rules for connecting to a Bastion host and the rules for connecting to a database from the Bastion host.

4-1. Add Security Group Security Rules

1. Click the All Services > Networking > Security Group menu. 1. Go to the Service Home page of the Security Group.
2. On the Service Home page, click the Security Group menu. 2. Go to the Security Group List page.
3. **1-5. 3. Select the Security Group resource created in Create a Security Group. 3. Navigates to the detailed information page for the specified resource.
4. On the details page, click the Rules tab. 4. Go to the Rules tab.
5. Click the Add Rule button in the Rules tab. 5. Navigates to the Add Rule popup.
6. In the Add Rule dialog box, enter the following rule and click the OK button.

   Direction	Remote	Target Address	Protocol	Port	Description
   Inbound	CIDR	User PC IP	TCP	3389 (RDP)	PC connected to Bastion → Bastion host
   Outbound	CIDR	DB IP	TCP	Database Port (Direct Input)	Bastion host → Database

   Table. Security Group security rules that must be added

4-2. Add an IGW Firewall Rule

1. Click the All Services > Networking > Firewall menu. 1. Go to the Service Home page of the Firewall.
2. On the Service Home page, click the Firewall menu. 2. Go to the Firewall List page.
3. On the Firewall List page, select the Internet Gateway resource name created in 1-3. Create an Internet Gateway. 3. Navigates to the detailed information page for the resource.
4. On the details page, click the Rules tab. 4. Go to the Rules tab.
5. Click the Add Rule button in the Rules tab. 5. Navigates to the Add Rule popup window.
6. In the Add Rule popup window, enter the rule below and click the OK button.

   Origin address	Destination address	Protocol	Port	Operation	Direction	Description
   IP address of the PC connected to Bastion	Bastion host IP	TCP	3389(RDP)	Allow	Inbound	User PC → Bastion host

   Table. Internet Gateway Firewall rules that must be added

5. Connecting to the Database

This section describes the process of connecting to a database using a DB client program.

This guide explains how to connect using pgAdmin. Database client programs and CLI utilities vary, so you can install and use the tool that best suits your needs.

5-1. Connecting to a Bastion Host

1. In the Windows environment of the PC you want to use to connect to the Bastion host, run Remote Desktop Connection, enter the Bastion Host’s NAT IP, and click the Connect button.
2. If the remote desktop connection is successful, the user credentials input window opens. 2. Enter the ID and Password that you verified in 2-3. Check the bastion host login ID and password, and then click the OK button.

5-2. Installing the DB client program (pgAdmin) on the bastion host

1. Go to the official pgAdmin page and download the pgAdmin program.
   • pgAdmin program download path: https://www.pgadmin.org/download/
2. Connect the hard drive of your user PC to the bastion host to upload the file.
3. In the Local Resources tab of Remote Desktop Connection, click the Details button for the local device and resource items.
4. Select the local disk where you downloaded the file on the drive, and click the OK button.
5. Copy the downloaded file and upload it to the Bastion Host, then click the pgAdmin installation file to install it.

5-3. Connecting to a Database Using a DB Client Program (pgAdmin)

1. Run pgAdmin and click the Add New Server button.
2. In the Register - Server popup window, enter the Database server information created in 3-1. EPAS(DBaaS) service creation in the General and Connection tabs, and then click the Save button.

   Screen (Tab)	Required input element items	Input
   General	Name	Custom (e.g., service name)
   Connection	Host name/address	Database server IP
   Connection	Port	Database Port
   Connection	Maintenance database	Database name
   Connection	Password	Database password

   Table. Database connection client program input fields
3. Click the name of the database created in pgAdmin to connect.
   • After connecting, you can run simple queries.