Securing Astra DB
Because security is a priority for all modern cloud applications, DataStax has implemented several protocols to ensure security remains a priority.
DataStax Astra DB is secured by default, including encryption over the wire and at rest. DataStax Astra DB instances are SOC2 Type2-compliant.
For details on Astra DB security, check out the Astra DB Security Whitepaper.
The following sections discuss security policies that are specific to Astra DB. To view security protocols implemented across DataStax, see Security assurance on the DataStax website.
Default Astra DB user permissions
When creating an DataStax Astra DB database, the default user is created with the required permissions to manage the created keyspace.
This default user is not equivalent to the cassandra superuser.
However, the default user is granted the following permissions in the keyspace created on the database:
-
Create, select, modify, drop, and describe database objects, including keyspaces, tables, and roles
-
Grant the same or lesser permissions to additional user roles
-
Create and drop additional user roles
|
You must be the default user to create additional users within the selected keyspace. |
Security guidelines
Because security is a priority for all modern cloud applications, DataStax has implemented several protocols to ensure security remains a priority.
DataStax Astra DB is a SOC2 Type2-compliant database that is secured by default including encryption over the wire and at rest.
For details on Astra DB security, check out the Astra DB Security Whitepaper.
The following sections discuss security policies that are specific to Astra DB. To view security protocols implemented across DataStax, see Security Assurance.
Change your login password
Complete the following steps if you know your login password for the DataStax Astra Portal and want to change it.
Procedure
-
Open a browser, navigate to Astra DB.
-
Click the link, Forgot Password?. Type your email/username in the Forgot Your Password? dialog box.
-
Click Reset My Password. A password reset link is sent to the email address associated with your account. If the email address you entered is found in the database, a message is sent to that address with a link to reset your password. The link expires within 15 minutes.
-
In the password reset email, select Link to account update to reset your password.
-
Select Click here to proceed.
-
In the Update Password window, enter a new password, confirm the password, and select Submit to change your password.
Result
Your new password is recorded and can be used for subsequent logins to Astra Portal. Use your new password to log in.
Reset your password
Complete the following steps if you forgot or lost your password and want to reset it.
Procedure
-
Open a browser, and navigate to DataStax Astra DB, and log in.
-
Go to the left navigation, and click your avatar. Select Account Settings.
-
In the Reset Your Password window, enter the email address associated with your account, then select Confirm. A password reset link is sent to the specified email address. The link expires within 15 minutes.
Result
Your password is reset and you are logged in to Astra DB.
Security highlights
More authentication options
On 4 March 2021, we updated Astra authentication to simplify how you connect with your database. Free and serverless databases were migrated to free plans with a $25 credit that renews each month. If your database was included in this migration, you will need to reset your database password.
Changes to your Astra database password
As of 4 March 2021, your existing database username and password will not work for your upgraded serverless databases. You will need to generate an application token to connect to your database with cqlsh, your existing driver, or any of our gRPC or REST or GraphQL APIs. To access your database via cqlsh or your existing driver, you will need to use the “Client ID” and “Client Secret” pair, that can be found when generating the application token, in place of your username and password respectively. This same Client ID and Client Secret pair can also be used as before when generating tokens to use with the gRPC or REST or GraphQL APIs or you can use the new “Token” generated as part of the application token. The new Token can be used in place of the existing authorization token generated by making a request to https://${ASTRA_DB_ID}-${ASTRA_DB_REGION}.apps.astra.datastax.com/api/rest/v1/auth. There is also one final option for authentication which is to use your existing Astra username and password in lieu of the previously mentioned Client ID and Client Secret but this is only recommended for development and testing use cases, not in production.
Easily manage complex user roles
To improve your security, you now have control over your user groups with custom roles and can assign roles by organization, database, keyspace, or tables. Your existing CQL roles will be mapped into new roles and can continue to be used in your local CQLSH. Other existing permissions have been mapped to an equivalent role with the same access.
You can also set up an application token for each role to interact with the gRPC, Document, REST, and GraphQL APIs. If you are connecting to your database using a driver, you will need to download a new secure connect bundle.
To continue using the DevOps API, you must regenerate your service account token.
Astra DB Plugin for HashiCorp Vault
DataStax Astra DB Plugin for HashiCorp Vault is an open-source project that adds dynamic token lifecycle management features for Astra DB. Due to the nature of the Astra DB object hierarchy, by default, API tokens are not associated with specific users and currently the tokens do not have metadata descriptions.
For more details, see the full Astra DB Plugin for HashiCorp Vault documentation in the plugin’s open-source GitHub repo.
Without the plugin, it’s easy to lose track of:
-
Who created tokens
-
The purpose of each token
-
Which tokens are being used actively
Consequently, there’s no audit trail of who has downloaded and used tokens, and there’s no tracking regarding who may have manually shared tokens with others.
Astra DB Plugin for HashiCorp Vault solves these security management issues. To ensure that your token ownership and usage are well understood, the plugin gives you the ability to associate metadata with tokens—such as the user who created each token, and what it is being used for. The plugin also logs who has accessed the tokens and provides dynamic token management.
Specifically, you can:
-
Define a default lease time
-
Create new tokens with lease settings
-
List tokens by each one’s Client ID
-
View lease details
-
List all leases
-
Renew a lease
-
Revoke a token/lease before the lease expires
-
Delete a token
What is Hashi Vault?
HashiCorp Vault is a widely-used solution across the tech industry. It’s an identity-based secrets and encryption management system. HashiCorp Vault from HashiCorp provides key-value encryption services that are gated by authentication and authorization methods. Access to tokens, secrets, and other sensitive data are securely stored, managed, and tightly controlled. Audit trails are provided. HashiCorp Vault is also extensible via a variety of interfaces, allowing plugins (including Astra DB Plugin for HashiCorp Vault) to contribute to this ecosystem.
What’s next?
See the full Astra DB Plugin for HashiCorp Vault documentation in the plugin’s open-source GitHub repo.