[
https://issues.apache.org/jira/browse/CASSSIDECAR-500?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bernardo Botella Corbi updated CASSSIDECAR-500:
-----------------------------------------------
Bug Category: Parent values: Security(12985)
Complexity: Normal
Discovered By: Adhoc Test
Fix Version/s: 0.5
Severity: Normal
Status: Open (was: Triage Needed)
https://github.com/apache/cassandra-sidecar/pull/384
> Sanitize/Nullify Cloud Credentials on RestoreJob Completion
> -----------------------------------------------------------
>
> Key: CASSSIDECAR-500
> URL: https://issues.apache.org/jira/browse/CASSSIDECAR-500
> Project: Sidecar for Apache Cassandra
> Issue Type: Bug
> Components: Bulk Analytics
> Reporter: Bernardo Botella Corbi
> Assignee: Bernardo Botella Corbi
> Priority: Major
> Fix For: 0.5
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> When a RestoreJob uses STATIC cloud credentials, secrets are stored in clear
> text within the sidecar_internal tables. Leaving them there for 90 days by
> default poses a security risk, especially since completed jobs are never
> replayed.
> The proposal is to update the job lifecycle manager to automatically nullify
> or redact sensitive credential fields from the stored payload as soon as a
> job reaches a terminal state (SUCCEEDED, FAILED, or ABORTED), while
> preserving the execution logs and metadata for auditing.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
