YDB for security engineers

This section of the YDB documentation covers security-related aspects of working with YDB. It is also useful for compliance purposes.

Key security elements and concepts of YDB

The YDB security system operates with the following concepts:

• Access subjects:

  • Users. YDB allows working with both local users and users from external sources (LDAP directories, IAM systems, etc.).
  • Groups. YDB allows combining users into named sets. The membership of a group can be changed later. A group can also be empty, containing no users.

• Access objects. In YDB, access objects are schema objects (tables, system views, etc.) for which access rights are configured.

• Access rights. Using access rights in YDB, the list of allowed operations on access objects for a specific user or group is defined.

  Access rights are the ability to perform certain actions (create, delete, read, update, etc.) on an access object.

  Access rights can be granted to a specific user or group. A user added to a group is granted the rights previously granted to that group for as long as they are in that group.

  For more information about access rights, see the section Access rights.

• Access levels. Using access levels in YDB, access to additional cluster management capabilities is defined for a specific user or group. YDB uses hierarchical access levels: database, viewer, monitoring, and administration. Higher levels automatically include all lower ones. Additionally, there are two special non-hierarchical lists: bootstrap (for initial cluster initialization) and register node (for registering dynamic nodes).

  For more information about access levels, see the section Access level lists.

• Authentication and authorization. The access control system in YDB provides a data protection mechanism in the YDB cluster. Only authenticated access subjects (users and groups) can work with data, and data access can be restricted.

  • Device authentication. When opening a TLS connection, YDB can verify the client certificate and thereby restrict the network perimeter. Such authentication is optional and is configured for supported interfaces. After device authentication, user authentication may still be required to access data.

  • Client authentication. When accessing the YDB cluster, users undergo authentication — a verification process that confirms the user's identity. YDB supports various authentication mechanisms; their detailed description can be found in the corresponding authentication section.

    It is important to note that regardless of the mechanism used, as a result of successful authentication, users receive an identifier (SID) and an authentication token.

    • The identifier in the form of SID is used to identify the user in YDB. For example, for local users, the user's login serves as the SID. For external users, the SID also contains information about the user's source. The user's SID can also be found in system views that describe the current security settings.

    • The authentication token is used by YDB nodes to authorize user access before processing their requests.

      The user can reuse the obtained authentication token multiple times in their work when executing queries to the YDB cluster. For more information about the authentication token, such as caching parameters, etc., see the section auth_config.

  • Authorization. Based on authentication data, authorization is performed — a process of checking for specific access rights and access levels for the user to perform the requested operation.

• Audit logs. Actions aimed at changing security settings are additionally logged in a separate journal called the audit log. This journal will primarily be of interest to those responsible for information security. The audit log includes actions such as creating or deleting access objects, creating or deleting users, changing passwords, granting or revoking access rights, and so on.

• Encryption. YDB is a distributed system that typically runs on clusters located in multiple data centers. To protect user data, YDB provides the following mechanisms:

  • data encryption in transit to ensure the security of data transmitted between the client and YDB, and between the nodes of the YDB cluster itself
  • data encryption at rest.