Ensure there are no unnecessary roles or excessive privileges

中レベル 2手動レビューyugabytedb

説明

Verify each role is required and has only the privileges needed to do its job.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

As a YCQL superuser run SELECT role, can_login, is_superuser, member_of FROM system_auth.roles; and SELECT * FROM system_auth.role_permissions; Any role that is not needed, or any role holding more permissions than its function requires, is a finding (DROP ROLE / REVOKE ... FROM ...).

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove any unnecessary roles and/or permissions in accordance with organizational needs. Drop unnecessary roles by issuing the following command: cassandra@ycqlsh> DROP ROLE IF EXISTS developer Alternatively, you can revoke permissions. For example, you can revoke the engineering role from the user john as follows: cassandra@ycqlsh> REVOKE engineering FROM john;

プロパティ

オペレーティングシステム: すべて
タグ: yugabytedbprivileges
参照: CIS YugabyteDB Benchmark v2.0.0 - 5.4 Ensure there are no unnecessary roles or excessive privileges