Securing Astra DB

Because security is a priority for all modern cloud applications, DataStax has implemented several protocols to ensure security remains a priority.

DataStax Astra DB is secured by default, including encryption over the wire and at rest. DataStax Astra DB classic instances are SOC2 Type2-compliant, and DataStax Astra DB serverless certification is in progress.

For details on Astra DB security, check out the Astra DB Security Whitepaper.

The following sections discuss security policies that are specific to Astra DB. To view security protocols implemented across DataStax, see Security assurance on the DataStax website.

Default Astra DB user permissions

When creating an DataStax Astra DB database, the default user is created with the required permissions to manage the created keyspace. This default user is not equivalent to the cassandra superuser. However, the default user is granted the following permissions in the keyspace created on the database:

  • Create, select, modify, drop, and describe database objects, including keyspaces, tables, and roles

  • Grant the same or lesser permissions to additional user roles

  • Create and drop additional user roles

You must be the default user to create additional users within the selected keyspace.

Security guidelines

Because security is a priority for all modern cloud applications, DataStax has implemented several protocols to ensure security remains a priority.

DataStax Astra DB is a SOC2 Type2-compliant database that is secured by default including encryption over the wire and at rest.

For details on Astra DB security, check out the Astra DB Security Whitepaper.

The following sections discuss security policies that are specific to Astra DB. To view security protocols implemented across DataStax, see Security assurance on the DataStax website.

Change your login password

Complete the following steps if you know your login password for the DataStax Astra DB console and want to change it.

Procedure

  1. Open a browser, navigate to Astra DB, and log in.

  2. In the upper-right corner, select the arrow next to your username and select Reset Password. A password reset link is sent to the email address associated with your account. If the email address you entered is found in the database, a message is sent to that address with a link to reset your password. The link expires within 12 hours.

  3. In the password reset email, select Link to account update to reset your password.

  4. Select Click here to proceed.

  5. In the Update Password window, enter a new password, confirm the password, and select Submit to change your password.

Result

Your new password is recorded and can be used for subsequent logins to the Astra DB console. Use your new password to log in.

Reset your password

Complete the following steps if you forgot or lost your password and want to reset it.

Procedure

  1. Open a browser, and navigate to DataStax Astra DB.

  2. On the Login page, click the Forgot Password link.

  3. In the Forgot Your Password window, enter the email address associated with your account, then select Submit. A password reset link is sent to the specified email address.

  4. In the password reset email, click the link to reset your password. The link expires after five minutes. A new browser tab opens to the Update Password page.

  5. In the Update Password page, enter a new password and confirm it.

  6. Select Submit to reset your password.

Result

Your password is reset and you are logged in to Astra DB.

Security highlights

More authentication options

On 4 March 2021, we updated Astra authentication to simplify how you connect with your database. Free and serverless databases were migrated to free plans with a $25 credit that renews each month. If your database was included in this migration, you will need to reset your database password.

Changes to your Astra database password

As of 4 March 2021, your existing database username and password will not work for your upgraded serverless databases. You will need to generate an application token to connect to your database with cqlsh, your existing driver, or any of our REST or GraphQL APIs. To access your database via cqlsh or your existing driver, you will need to use the “Client ID” and “Client Secret” pair, that can be found when generating the application token, in place of your username and password respectively. This same Client ID and Client Secret pair can also be used as before when generating tokens to use with the REST or GraphQL APIs or you can use the new “Token” generated as part of the application token. The new Token can be used in place of the existing authorization token generated by making a request to https://${ASTRA_DB_ID}-${ASTRA_DB_REGION}.apps.astra.datastax.com/api/rest/v1/auth. There is also one final option for authentication which is to use your existing Astra username and password in lieu of the previously mentioned Client ID and Client Secret but this is only recommended for development and testing use cases, not in production.

Easily manage complex user roles

To improve your security, you now have control over your user groups with custom roles and can assign roles by organization, database, keyspace, or tables. Your existing CQL roles will be mapped into new roles and can continue to be used in your local CQLSH. Other existing permissions have been mapped to an equivalent role with the same access.
You can also set up an application token for each role to interact with the Document, REST, and GraphQL APIs. If you are connecting to your database using a driver, you will need to download a new secure connect bundle.
To continue using the DevOps API, you must regenerate your service account token.

Astra DB Plugin for HashiCorp Vault

DataStax Astra DB Plugin for HashiCorp Vault is an open-source project that adds robust token lifecycle management features for Astra DB. Due to the nature of the Astra DB object hierarchy, by default, API tokens are not associated with specific users and currently the tokens do not have metadata descriptions.

For more details, see the full Astra DB Plugin for HashiCorp Vault documentation in the plugin’s open-source GitHub repo.

Without the plugin, it’s easy to lose track of:

  • Who created tokens

  • The purpose of each token

  • Which tokens are being used actively

Consequently, there’s no audit trail of who has downloaded and used tokens, and there’s no tracking regarding who may have manually shared tokens with others.

Astra DB Plugin for HashiCorp Vault solves these security management issues. To ensure that your token ownership and usage are well understood, the plugin gives you the ability to associate metadata with tokens—such as the user who created each token, and what it is being used for. The plugin also logs who has accessed the tokens.

What is Hashi Vault?

HashiCorp Vault is a widely-used solution across the tech industry. It’s an identity-based secrets and encryption management system. HashiCorp Vault from HashiCorp provides key-value encryption services that are gated by authentication and authorization methods. Access to tokens, secrets, and other sensitive data are securely stored, managed, and tightly controlled. Audit trails are provided. HashiCorp Vault is also extensible via a variety of interfaces, allowing plugins (including Astra DB Plugin for HashiCorp Vault) to contribute to this ecosystem.

What’s next?

See the full Astra DB Plugin for HashiCorp Vault documentation in the plugin’s open-source GitHub repo.