YDB for Security Engineers

This section of the YDB documentation covers security-related aspects of working with YDB. It will also be useful for compliance purposes.

YDB security elements and concepts

The YDB security system operates with the following concepts:

• Access subjects:

  • Users. YDB supports both internal users and external users from third-party directory services, such as LDAP and IAM systems.
  • Groups. YDB allows you to combine users into named sets. The composition of users in a group can be changed later. A group can also be empty — containing no users.

• Access objects. In YDB, access objects are schema objects (tables, system views, etc.) for which access rights are configured.

• Access rights. Access rights in YDB define the list of allowed operations on access objects for a specific user or group.

  Access rights are the ability to perform certain actions (create, delete, read, update, etc.) on an access object.

  Access rights can be granted to a specific user or a group. A user who is added to a group is granted the rights previously assigned to that group for the duration of their membership in the group.

  For more information about access rights, see Right.

• Access levels. Access levels in YDB define access to additional cluster management capabilities for a specific user or group. YDB uses hierarchical access levels: database, viewer, monitoring, and administration. Higher levels automatically include all lower ones. Additionally, there are two special non-hierarchical lists: bootstrap (for initial cluster initialization) and register node (for registering dynamic nodes).

  For more information about access levels, see Access level lists.

• Device authentication. When opening a TLS connection, YDB can verify the client certificate and thus restrict the network perimeter. Such authentication is optional and configurable for supported interfaces. After device authentication, user authentication may still be required to access data.

• Authentication and authorization. The access control system in YDB provides data protection in a YDB cluster. Due to the access system, only authorized access subjects (users and groups) can work with data. Access to data can be restricted.

  • Authentication. When accessing a YDB cluster, users undergo authentication — a verification process that confirms the user's identity. YDB supports various authentication mechanisms; their detailed description can be found in the corresponding authentication section.

    It is important to note that regardless of the mechanism used, upon successful authentication users receive an identifier (SID) and an authentication token.

    • The identifier in the form of a SID is used to identify a user in YDB. For example, for local users, the SID is the user's login. For external users, the SID also contains information about the user's origin. The user's SID can also be found in system views that describe current security settings.

    • The authentication token is used by YDB nodes to authorize user access before processing their requests.

      The user can then use the received authentication token repeatedly when making requests to the YDB cluster. For more information about the authentication token and related configuration parameters, see auth_config.

  • Authorization. Based on the authentication data, a user then goes through authorization — a process that verifies whether a user has sufficient access rights and access levels to perform user operations.

• Audit logs. Actions aimed at changing security settings are additionally logged in a separate journal called the audit log. This journal will primarily be of interest to those responsible for information security. The audit log captures actions such as creating or deleting access objects, creating or deleting users, changing passwords, granting or revoking access rights, etc.

• Encryption. YDB is a distributed system typically running on clusters located in multiple data centers. To protect user data, YDB provides the following mechanisms:

  • encryption in transit to secure data transmitted between a client and YDB, and between nodes of the YDB cluster.
  • data encryption at rest.