[
https://issues.apache.org/jira/browse/CASSSIDECAR-500?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bernardo Botella Corbi updated CASSSIDECAR-500:
-----------------------------------------------
Authors: Bernardo Botella Corbi
Test and Documentation Plan:
https://github.com/apache/cassandra-sidecar/pull/384
Status: Patch Available (was: Open)
> Sanitize/Nullify Cloud Credentials on RestoreJob Completion
> -----------------------------------------------------------
>
> Key: CASSSIDECAR-500
> URL: https://issues.apache.org/jira/browse/CASSSIDECAR-500
> Project: Sidecar for Apache Cassandra
> Issue Type: Bug
> Components: Bulk Analytics
> Reporter: Bernardo Botella Corbi
> Assignee: Bernardo Botella Corbi
> Priority: Major
> Fix For: 0.5
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> When a RestoreJob uses STATIC cloud credentials, secrets are stored in clear
> text within the sidecar_internal tables. Leaving them there for 90 days by
> default poses a security risk, especially since completed jobs are never
> replayed.
> The proposal is to update the job lifecycle manager to automatically nullify
> or redact sensitive credential fields from the stored payload as soon as a
> job reaches a terminal state (SUCCEEDED, FAILED, or ABORTED), while
> preserving the execution logs and metadata for auditing.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
