Ensure excessive DML privileges are revoked

보통레벨 1수동 검토yugabytedb

설명

DML (insert, update, delete) operations at the table level should be restricted to only authorized users. YugabyteDB manages table-level DML permissions via the GRANT statement.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

In each database list users (\du+ *) and tables (\dt *.*) and review table grants (\dp or information_schema.role_table_grants). Any user holding INSERT, UPDATE, DELETE or TRUNCATE on tables it does not need for its role is a finding; revoke with REVOKE <priv> ON <table> FROM <user>.

조치 방법

조치 방식: 가이드 또는 인프라 패치

If a given database user has been granted excessive DML privileges for a given database table, those privileges should be revoked immediately using the REVOKE YSQL command. Continuing with the example above, remove unauthorized grants for appreader user using the REVOKE statement and verify the Boolean values are now false. yugabyte=# REVOKE INSERT, UPDATE, DELETE ON TABLE customer FROM appreader;

속성

운영 체제: 모두
태그: yugabytedbprivileges
참고 자료: CIS YugabyteDB Benchmark v2.0.0 - 4.4 Ensure excessive DML privileges are revoked