Description

Ensure production Public Cloud Database services are connected to a private network (vRack), so that applications reach them over private addresses instead of the public internet.

Rationale

Databases with only a public endpoint must be reached over the internet, which exposes them to scanning and attacks. A private network keeps database traffic isolated from the internet and allows access only from resources on that network.

Impact

  • Database traffic stays on the private network

  • Removes public exposure of the database

  • Applications must be on the same private network

Default Value

By default, database services use public networking unless a private network is selected.

Pre-Requisites

  • Permission to manage the database service

  • A vRack, a private network, and a subnet in the same region

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. On the Dashboard tab, check the network type (public or private).

  5. If a production database uses public networking, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Update the network configuration of the service to use the private network and subnet, if the engine supports it; otherwise create a new service on the private network and migrate the data.

  5. Update the applications to use the private connection details.

  6. Confirm that applications can connect.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Switch the applications back to the previous connection details, or revert the network configuration.

Reference