Skip to content

Commit ad36311

Browse files
biplav-crlbiplav-crl
authored
Merge pull request #1 from cockroachlabs/skill/security-and-governance/expand-security-skills
Skill/security and governance/expand security skills
2 parents c248535 + 4ee92e9 commit ad36311

File tree

29 files changed

+6404
-0
lines changed

29 files changed

+6404
-0
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,3 +78,6 @@ coverage/
7878
# Backup Files
7979
*.bak
8080
*.backup
81+
82+
# Audit report run logs (local-only, not committed)
83+
**/reports/

‎skills/security-and-governance/auditing-cloud-cluster-security/SKILL.md‎

Lines changed: 548 additions & 0 deletions
Large diffs are not rendered by default.

‎skills/security-and-governance/auditing-cloud-cluster-security/references/ccloud-commands.md‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
# ccloud CLI Commands for Security Auditing
2+
3+
This reference provides `ccloud` CLI commands used during security posture assessments. All commands are read-only operations.
4+
5+
## Authentication
6+
7+
### Verify Authentication
8+
9+
```bash
10+
# Check current authentication status
11+
ccloud auth whoami
12+
```
13+
14+
### Login (If Not Authenticated)
15+
16+
```bash
17+
# Interactive login (opens browser)
18+
ccloud auth login
19+
```
20+
21+
## Cluster Information
22+
23+
### List All Clusters
24+
25+
```bash
26+
# List clusters in the organization
27+
ccloud cluster list -o json
28+
```
29+
30+
### Get Cluster Info
31+
32+
```bash
33+
# Get detailed cluster info including plan type, regions, version
34+
# Accepts cluster name or ID
35+
ccloud cluster info <cluster-name> -o json
36+
```
37+
38+
**Key fields to inspect:**
39+
- `plan` — Basic, Standard, or Advanced
40+
- `cockroach_version` — CockroachDB version
41+
- `regions` — Deployed regions
42+
- `state` — Cluster state (CREATED, READY, etc.)
43+
44+
## Network Security
45+
46+
### List IP Allowlist Entries
47+
48+
```bash
49+
# List all IP allowlist entries
50+
ccloud cluster networking allowlist list <cluster-id> -o json
51+
```
52+
53+
**Key fields to inspect:**
54+
- `cidr_ip` / `cidr_mask` — The allowed IP range
55+
- `name` — Description of the entry
56+
- `sql` — Whether SQL access is allowed
57+
- `ui` — Whether DB Console access is allowed
58+
59+
**Red flags:**
60+
- `0.0.0.0/0` — Open to all IPv4 addresses
61+
- `/8` or `/16` ranges — Overly broad network access
62+
63+
### List Private Endpoint Connections
64+
65+
Private endpoint connections are managed via the **Cloud Console** or **Cloud API** (not the `ccloud` CLI).
66+
67+
**Cloud Console:** Navigate to your cluster's **Networking > Private endpoint** tab.
68+
69+
**Cloud API:**
70+
```bash
71+
curl "https://cockroachlabs.cloud/api/v1/clusters/<cluster-id>/networking/private-endpoint-connections" \
72+
-H "Authorization: Bearer <api-key>"
73+
```
74+
75+
## SSO and SCIM
76+
77+
Cloud Console SSO and SCIM 2.0 are configured via the **Cloud Console UI** (Organization Settings > Authentication). The `ccloud` CLI does not currently expose SSO or SCIM configuration commands.
78+
79+
**To check SSO status:**
80+
1. Log into the CockroachDB Cloud Console
81+
2. Navigate to Organization Settings > Authentication
82+
3. Check if SSO (SAML/OIDC) is enabled and whether it is enforced
83+
84+
**To check SCIM status:**
85+
1. Log into the CockroachDB Cloud Console
86+
2. Navigate to Organization Settings > Authentication > SCIM
87+
3. Check if the SCIM endpoint is enabled and connected to an IdP
88+
89+
**Database SSO (Cluster SSO)** is checked via SQL — see the SQL queries reference.
90+
91+
## Encryption (CMEK)
92+
93+
### Check CMEK Status
94+
95+
```bash
96+
# CMEK configuration is part of cluster info output
97+
ccloud cluster info <cluster-name> -o json
98+
# Look for cmek_config section
99+
```
100+
101+
**Key fields to inspect:**
102+
- `cmek_config.status` — CMEK status (enabled/disabled)
103+
- `cmek_config.key_spec` — KMS key details
104+
105+
**Note:** CMEK requires Advanced plan with Advanced Security Add-on.
106+
107+
## Backup Configuration
108+
109+
### Check Managed Backup Status
110+
111+
```bash
112+
# Backup configuration is part of cluster info output
113+
ccloud cluster info <cluster-name> -o json
114+
# Look for backup_config section
115+
```
116+
117+
**Key fields to inspect:**
118+
- `backup_config.frequency` — Backup frequency
119+
- `backup_config.retention` — Backup retention period
120+
121+
**Note:** CockroachDB Cloud automatically manages backups for all clusters. This is informational only.
122+
123+
## SQL User Management
124+
125+
### List SQL Users
126+
127+
```bash
128+
# List SQL users for a cluster
129+
ccloud cluster user list <cluster-name>
130+
```
131+
132+
### Create SQL User
133+
134+
```bash
135+
# Create a SQL user with password
136+
ccloud cluster user create <cluster-name> <username> -p '<password>'
137+
```
138+
139+
### Connect via SQL
140+
141+
```bash
142+
# Open interactive SQL shell
143+
ccloud cluster sql <cluster-name> -u <username> -p '<password>'
144+
145+
# Get connection URL (for use with cockroach sql)
146+
ccloud cluster sql <cluster-name> -u <username> -p '<password>' --connection-url
147+
```
148+
149+
## Output Formatting
150+
151+
All commands support `-o json` for machine-readable output:
152+
153+
```bash
154+
# JSON output (recommended for automation)
155+
ccloud cluster list -o json
156+
157+
# Table output (default, human-readable)
158+
ccloud cluster list
159+
```
160+
161+
## Notes
162+
163+
- All audit commands are read-only (`list`, `info`, `whoami`)
164+
- No commands modify cluster state, network configuration, or user access
165+
- JSON output (`-o json`) is recommended for structured parsing during audits
166+
- SSO and SCIM configuration must be checked via the Cloud Console UI
167+
- Cluster networking commands accept cluster ID; other commands accept cluster name or ID

‎skills/security-and-governance/auditing-cloud-cluster-security/references/permissions.md‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# RBAC and Privileges for Security Auditing
2+
3+
This reference details the privileges required to run security audit queries and how to grant minimal access for audit operations.
4+
5+
## Required Privileges
6+
7+
### For Full Security Audit
8+
9+
| Privilege | Purpose | Required? |
10+
|-----------|---------|-----------|
11+
| `admin` role | Full cluster visibility, all settings, all grants | Recommended |
12+
| `VIEWACTIVITY` | View all active sessions and queries | Alternative to admin |
13+
| `VIEWACTIVITYREDACTED` | View sessions with redacted constants | Minimum for session visibility |
14+
15+
### For Specific Audit Checks
16+
17+
| Audit Check | Minimum Privilege | Notes |
18+
|-------------|------------------|-------|
19+
| User/role listing | Any authenticated user | `SHOW USERS` is available to all |
20+
| Admin role membership | Any authenticated user | `SHOW GRANTS ON ROLE admin` is available to all |
21+
| PUBLIC grants | Any authenticated user | `SHOW GRANTS FOR public` is available to all |
22+
| Cluster settings | `admin` or `MODIFYCLUSTERSETTING` | `SHOW CLUSTER SETTING` requires elevated access |
23+
| System grants | `admin` | `SHOW SYSTEM GRANTS` requires admin |
24+
| Database grants | Database-level privilege | Can view grants on databases you have access to |
25+
26+
### For ccloud CLI
27+
28+
| Operation | Required Cloud Console Role |
29+
|-----------|---------------------------|
30+
| `ccloud cluster list` | Org Member (minimum) |
31+
| `ccloud cluster describe` | Cluster Reader (minimum) |
32+
| `ccloud cluster networking allowlist list` | Cluster Reader |
33+
| `ccloud auth describe-sso` | Org Admin |
34+
| `ccloud auth describe-scim` | Org Admin |
35+
36+
## Granting Audit Privileges
37+
38+
### Option 1: Create a Dedicated Audit Role (Recommended)
39+
40+
```sql
41+
-- Create a security audit role with read-only access
42+
CREATE ROLE security_auditor;
43+
44+
-- Grant the minimum privileges for a full audit
45+
GRANT SYSTEM VIEWACTIVITYREDACTED TO security_auditor;
46+
47+
-- Assign the role to audit users
48+
GRANT security_auditor TO <audit_username>;
49+
```
50+
51+
**Limitation:** Some cluster setting queries require admin. The auditor will get partial results for those checks, which the audit report will note.
52+
53+
### Option 2: Use Admin Role (Full Visibility)
54+
55+
```sql
56+
-- Grant admin for complete audit coverage
57+
GRANT admin TO <audit_username>;
58+
```
59+
60+
**Warning:** Admin grants full cluster control. Only use for trusted audit operators and consider revoking after the audit.
61+
62+
### Option 3: Temporary Admin Grant
63+
64+
```sql
65+
-- Grant admin temporarily for the audit
66+
GRANT admin TO <audit_username>;
67+
68+
-- After audit is complete, revoke
69+
REVOKE admin FROM <audit_username>;
70+
```
71+
72+
## Checking Current Privileges
73+
74+
```sql
75+
-- Check your own privileges
76+
SHOW GRANTS ON ROLE <your_username>;
77+
78+
-- Check system-level privileges
79+
SHOW SYSTEM GRANTS;
80+
81+
-- Check if you have admin
82+
SELECT member FROM [SHOW GRANTS ON ROLE admin] WHERE member = current_user();
83+
```
84+
85+
## Security Best Practices for Audit Access
86+
87+
1. **Use dedicated audit accounts** — Do not use personal admin accounts for audits
88+
2. **Time-bound access** — Grant admin temporarily and revoke after the audit
89+
3. **Use VIEWACTIVITYREDACTED** — Protects sensitive data in query constants
90+
4. **Audit the auditor** — Enable admin audit logging before granting audit access
91+
5. **Document access grants** — Track who has audit privileges and why
92+
93+
```sql
94+
-- Enable admin audit logging before granting audit access
95+
SET CLUSTER SETTING sql.log.admin_audit.enabled = true;
96+
97+
-- Then grant temporary audit access
98+
GRANT admin TO audit_user;
99+
```
100+
101+
## References
102+
103+
**Official CockroachDB Documentation:**
104+
- [Authorization Overview](https://www.cockroachlabs.com/docs/stable/security-reference/authorization.html)
105+
- [GRANT (System Privilege)](https://www.cockroachlabs.com/docs/stable/grant.html)
106+
- [SHOW GRANTS](https://www.cockroachlabs.com/docs/stable/show-grants.html)
107+
- [Cloud Console Roles](https://www.cockroachlabs.com/docs/cockroachcloud/authorization.html)

0 commit comments

Comments
 (0)