Control Key Data Usage for Multi-Region Clusters with Data Localization Restrictions

OrtaDüzey 1Manuel incelemecockroachdb

Açıklama

In self-hosted CockroachDB multi-region clusters, organizations must ensure that Personally Identifiable Information (PII) or other regulated data is not used as part of primary key constraints or secondary indexes. In CockroachDB, primary keys define the primary index, and primary key columns are implicitly included in all secondary indexes. When a column is included in a primary key or index, its values are: 1.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

If the cluster uses multi-region features (SHOW REGIONS FROM DATABASE; REGIONAL BY ROW / GLOBAL tables), identify tables holding PII subject to data-localization rules and review SHOW CREATE TABLE for each: PII must not be used in primary keys or secondary index keys (key data is replicated to meta ranges in all regions). Single-region clusters are not applicable.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

1. Replace PII-based keys with surrogate keys Refactor schemas so that primary keys use surrogate identifiers instead of PII. CockroachDB recommends: - Using UUID-typed columns with default values generated by gen_random_uuid() for single-column primary keys. - Using composite primary keys where the leading column is a well-distributed, non-sensitive identifier. Ensure PII columns are stored as regular, non-indexed fields where possible.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: cockroachdbdata-protection
Referans: CIS CockroachDB v25.x Benchmark v1.0.0 - 5.3 Control Key Data Usage for Multi-Region Clusters with Data Localization Restrictions