Bernardo Botella Corbi created CASSSIDECAR-501:
--------------------------------------------------
Summary: Introduce Server-Side Configuration to Enforce Allowed
Credential Modes
Key: CASSSIDECAR-501
URL: https://issues.apache.org/jira/browse/CASSSIDECAR-501
Project: Sidecar for Apache Cassandra
Issue Type: Improvement
Components: Bulk Analytics
Reporter: Bernardo Botella Corbi
The Sidecar relies on client-side payload selection for credential types
(introduced in CASSSIDECAR-415). Cluster operators cannot block users from
passing insecure STATIC keys if they want to enforce IAM-only configurations
across a multi-tenant platform.
The proposal is to add a validation policy config block to sidecar.yaml (e.g.,
allowed_credential_types). If a user attempts to submit a restore job with a
disabled credential method, the Sidecar server should instantly reject it with
an HTTP 400 or HTTP 403 error.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
