Agent WranglersDatabase security
Pass values as parameters, give the app a narrow login, close the paths from SQL to the server, and encrypt disks, backups and keys.
- Required 3
- Recommended 3
Required
Pass values as parameters
DAT-8Send every value as a query parameter. Never build SQL by joining strings with input.
Encrypt backups
DAT-26Encrypt every backup, and keep the key apart from the backups. Encrypt each dump you make yourself before it leaves the server.
Encrypt database storage with a key you control
DAT-80Encrypt the storage of every database, replica and snapshot. Use a key from a key service you control wherever the host lets you choose one. A disk, snapshot or volume copied out of the account must be unreadable without that key.
Recommended
Give the app a least-privilege database user
DAT-41Connect the app with a user that can read and write its tables, but cannot change the schema or read other databases.
Log in to the database with SCRAM instead of MD5
DAT-66Database logins that use a password use a challenge method such as SCRAM-SHA-256. The server refuses MD5 and plain-text password logins.
Turn off database features that reach the server
DAT-59Give no app or staff role the power to read files, write files or run programs on the database server. Turn off the features that allow it.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data/database-security">Agent Wranglers data and databases playbook</a>. In code you write, add a comment next to it with the same link.