Connecting to the DB server

Scenario Overview

The PostgreSQL (DBaaS) server connection scenario involves creating a Bastion host (Virtual Server) and a Database service, and then accessing the DB service through the Bastion host. To establish a stable connection to PostgreSQL (DBaaS) in the Samsung Cloud Platform environment, you must create a bastion host and use it for network connectivity. To maintain a stable and highly secure environment, we recommend configuring the Database service in a private subnet and the bastion host in a restricted public subnet.

This scenario describes the process of creating a Bastion host and a Database service, configuring the network environment for connecting the Bastion host to the Database, and then connecting to the database using a DB client.

Scenario Components

You can configure the scenario using the following services.

How to Configure Scenarios

Create the services needed to build a scenario by following the steps below.

1. Configure the network

This section describes the process of configuring the network environment for connecting to the Bastion Host and Database services.

1-1. Create a VPC

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Create VPC button. 2. Go to the Create VPC page.
3. On the Create VPC page, enter the information required to create the service.
   • Enter the IP range as 192.168.x.0/16.
4. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resources on the VPC List page.

1-2. Create a Subnet

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Subnet menu. 2. Go to the Subnet List page.
3. Click the Create Subnet button. 3. Go to the Create Subnet page.
4. On the Create Subnet page, enter the information required to create the service.
   • Select General as the subnet type.
   • Select a pre-created VPC.
   • Enter the IP range as 192.168.x.0/24.
5. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the Subnet List page.

1-3. Create an Internet Gateway

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Internet Gateway menu. 2. Go to the Internet Gateway List page.
3. Click the Create Internet Gateway button. 3. Navigate to the Create Internet Gateway page.
4. On the Create Internet Gateway page, enter the required information to create the service.
   • Select a pre-created VPC.
   • Select Use in the Firewall usage field.
5. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the Internet Gateway List page.

1-4. Create a Public IP

1. Click the All Services > Networking > VPC menu. 1. Go to the Service Home page of the VPC.
2. On the Service Home page, click the Public IP menu. 2. Navigates to the Public IP List page.
3. Click the Reserve Public IP button. 3. Navigates to the Public IP Reservation page.
4. On the Public IP Reservation page, enter the required information for the service reservation.
5. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the Public IP List page.

1-5. Create a Security Group

1. Click the All Services > Networking > Security Group menu. 1. Go to the Service Home page of the Security Group.
2. On the Service Home page, click the Create Security Group button. 2. Navigate to the Create Security Group page.
3. On the Create Security Group page, enter the required information needed to create the service.
4. Review the input information and click the Complete button.
   • After creation is complete, verify the created resource on the Security Group List page.

2. Create a Bastion Host

This section describes the process of configuring the Bastion Host where the database connection client must be installed.

2-1. Create a Server Keypair

1. Click the All Services > Compute > Virtual Server menu. 1. Go to the Service Home page of the Virtual Server.
2. On the Service Home page, click the Keypair menu. 2. Go to the Keypair List page.
3. Click the Create Keypair button. 3. Navigate to the Create Keypair page.
4. On the Create Keypair page, enter the required information needed to create the service.
5. Review the generation information and click the Complete button.
   • You can download the key only on the first occasion, and reissuance is not available.
   • Be sure to store the downloaded key in a secure location.

2-2. Create a bastion host

1. Click the All Services > Compute > Virtual Server menu. 1. Go to the Service Home page of the Virtual Server.
2. On the Service Home page, click the Create Virtual Server button. 2. Go to the Create Virtual Server page.
3. Enter the required information to create a service on the Create Virtual Server page.
   • Select Windows for the image.
   • Select the pre-created VPC and Subnet.
   • Click Use NAT and select the Public IP reserved in 1-4. Create a Public IP.
   • Connect the Keypair created in 2-1. Create a Server Keypair.
4. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the Virtual Server List page.

2-3. Check the Bastion host login ID and password

1. Click the All Services > Compute > Virtual Server menu. 1. Go to the Service Home page of the Virtual Server.
2. On the Service Home page, click the Virtual Server menu. 2. Go to the Virtual Server List page.
3. On the Virtual Server List page, click the resource created in 2-2. Create a Bastion Host. 3. Navigates to the detailed information page for the specified resource.
4. On the details page, click the RDP password lookup button in the Keypair name field. 4. The RDP password lookup popup window opens.
5. In the RDP password lookup popup, attach the keypair file downloaded from 2-1. Create server Keypair.
6. After attaching, click the Password 확인 button. 6. The ID and password for accessing the resource are displayed.
   • The ID and password are used to connect to the Bastion host, as described in 5-1. Connecting to the Bastion host.

3. Creating a Database

This section describes the process of creating a Database service.

3-1. Create a PostgreSQL (DBaaS) Service

1. Click the All Services > Database > PostgreSQL(DBaaS) menu. 1. Go to the Service Home page of PostgreSQL (DBaaS).
2. On the Service Home page, click the Create PostgreSQL (DBaaS) button. 2. Go to the Create PostgreSQL (DBaaS) page.
3. Enter the required information to create a service on the Create PostgreSQL (DBaaS) page.
   • Select and connect the pre-created VPC and Subnet.
   • Enter the Database-related creation information on the required information input screen.
   • Add the Bastion host IP to the IP access control entry.
   • The default database port is 2866, but you can specify a different port.
4. Review the details and estimated billing amount generated in the Summary panel, and then click the Complete button.
   • After creation is complete, verify the created resource on the PostgreSQL(DBaaS) list page.

4. Configure Rules

This section describes how to configure the rules for connecting to a Bastion host and the rules for connecting to a database from the Bastion host.

4-1. Add Security Group Rules

1. Click the All Services > Networking > Security Group menu. 1. Go to the Service Home page of the Security Group.
2. On the Service Home page, click the Security Group menu. 2. Go to the Security Group List page.
3. **1-5. 3. Select the Security Group resource created in Create a Security Group. 3. Navigates to the detailed information page for the specified resource.
4. On the details page, click the Rules tab. 4. Go to the Rules tab.
5. Click the Add Rule button in the Rules tab. 5. Navigates to the Add Rule popup window.
6. In the Add Rule popup window, enter the rule below and click the OK button.

   Direction	Remote	Target Address	Protocol	Port	Description
   Inbound	CIDR	User PC IP	TCP	3389 (RDP)	PC connected to Bastion → Bastion host
   Outbound	CIDR	DB IP	TCP	Database Port (Direct Input)	Bastion host → Database

   Table. Security Group security rules that must be added

4-2. Add an IGW Firewall Rule

1. Click the All Services > Networking > Firewall menu. 1. Go to the Service Home page of the Firewall.
2. On the Service Home page, click the Firewall menu. 2. Go to the Firewall List page.
3. On the Firewall List page, select the Internet Gateway resource name created in 1-3. Create an Internet Gateway. 3. Navigates to the detailed information page for the specified resource.
4. On the details page, click the Rules tab. 4. Go to the Rules tab.
5. Click the Add Rule button in the Rules tab. 5. Navigates to the Add Rule popup window.
6. In the Add Rule popup window, enter the following rule and click the OK button.

   Origin address	Destination Address	Protocol	Port	Operation	Direction	Description
   IP address of the PC connected to Bastion	Bastion host IP	TCP	3389(RDP)	Allow	Inbound	User PC → Bastion host

   Table. Internet Gateway Firewall rules that must be added

5. Connecting to the Database

This section describes the process of connecting to a database using a DB client program.

This guide explains how to connect using pgAdmin. Database client programs and CLI utilities vary, so you can install and use the tool that best suits your needs.

5-1. Connecting to a Bastion Host

1. In the Windows environment of the PC you want to use to connect to the Bastion host, run Remote Desktop Connection, enter the Bastion Host’s NAT IP, and click the Connect button.
2. If the remote desktop connection succeeds, the user credentials input window opens. 2. Enter the ID and password that you verified in 2-3. Check the bastion host login ID and password, and then click the OK button.

5-2. Installing the DB client program (pgAdmin) on the bastion host

1. Go to the official pgAdmin page and download the pgAdmin program.
   • pgAdmin program download path: https://www.pgadmin.org/download/
2. Connect the hard drive of your user PC to the bastion host to upload the file.
3. In the Local Resources tab of Remote Desktop Connection, click the Details button for the local devices and resources item.
4. Select the local disk where you downloaded the file from the drive, and click the OK button.
5. Copy the downloaded file and upload it to the Bastion Host, then click the pgAdmin installation file to install it.

5-3. Connecting to a Database Using a DB Client Program (pgAdmin)

1. Run pgAdmin and click the Add New Server button.
2. In the Register - Server popup window, enter the Database server information created in 3-1. Creating a PostgreSQL (DBaaS) Service in the General and Connection tabs, and then click the Save button.

   Screen (Tab)	Required input element items	Input
   General	Name	Custom (e.g., service name)
   Connection	Host name/address	Database server IP
   Connection	Port	Database Port
   Connection	Maintenance database	Database name
   Connection	Password	Database password

   Table. Database client program input fields
3. Click the name of the database created in pgAdmin to connect to it.
   • After connecting, you can run simple queries.