Ensure excessive administrative privileges are revoked

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Run ysqlsh -c "\du" and compare each role with the superuser baseline (\du yugabyte). Only approved administrators may hold Superuser, Create role, Create DB, Replication or Bypass RLS; regular or application roles with these attributes are a finding (fix with ALTER ROLE <r> NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS).

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

If any regular or application users have been granted excessive administrative rights, those privileges should be removed immediately via the Yugabyte ALTER ROLE YSQL command. Using the same example above, the following YSQL statements revoke all unnecessary elevated administrative privileges from the regular user appuser: # whoami yugabyte # ysqlsh -c "ALTER ROLE appuser NOSUPERUSER;" ALTER ROLE # ysqlsh -c "ALTER ROLE appuser NOCREATEROLE;" ...