[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-auditing-cloud-cluster-security":3,"mdc--jiovyf-key":39,"related-repo-cockroachdb-auditing-cloud-cluster-security":5027,"related-org-cockroachdb-auditing-cloud-cluster-security":5114},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"auditing-cloud-cluster-security","audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Operations","operations",{"name":20,"slug":21,"type":15},"Audit","audit",{"name":23,"slug":24,"type":15},"Database","database",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:57:01.506735",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fauditing-cloud-cluster-security","---\nname: auditing-cloud-cluster-security\ndescription: Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.\ncompatibility: Requires ccloud CLI authenticated via `ccloud auth login` and SQL access via cockroach sql with admin or VIEWACTIVITY privilege.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Auditing Cloud Cluster Security\n\nAssesses the security posture of a CockroachDB Cloud cluster by examining network access controls, authentication and SSO configuration, user authorization, encryption, audit logging, and backup status. Produces a structured PASS\u002FWARN\u002FFAIL report with remediation links for each finding. Supports both CockroachDB Cloud and self-hosted clusters — checks that don't apply to the deployment model are marked N\u002FA.\n\n**Read-only audit:** All operations are read-only. No cluster state is modified during the assessment.\n\n## When to Use This Skill\n\n- Preparing for SOC 2, HIPAA, or other compliance reviews\n- Conducting periodic security posture assessments\n- Onboarding a new production cluster and validating security baseline\n- Investigating security configuration gaps after an incident\n- Reviewing cluster security before a major release or customer onboarding\n\n## Prerequisites\n\n**Tools:**\n\n| Tool | Cloud | Self-Hosted | Purpose |\n|------|-------|-------------|---------|\n| `ccloud` CLI | Required | N\u002FA | Cluster metadata, network config, CMEK |\n| `cockroach sql` | Required | Required | SQL security checks |\n| `openssl` (v3+) | Recommended | Recommended | TLS\u002FPQC cipher probing (`-starttls postgres`) |\n| `sslyze` | Optional | Optional | Comprehensive TLS enumeration (`--starttls postgres`) |\n\n**Credentials:**\n\n| Credential | Cloud | Self-Hosted |\n|---|---|---|\n| `ccloud auth login` session | Required | N\u002FA |\n| SQL connection string | Required (from `ccloud cluster sql --url`) | Required (user provides) |\n| DB username\u002Fpassword | Required (admin or VIEWACTIVITY) | Required (admin or VIEWACTIVITY) |\n| TLS certificates directory | N\u002FA (managed) | Required for cert expiry checks |\n| CA certificate file | N\u002FA | Required for `openssl` TLS probing |\n\nSee [permissions reference](references\u002Fpermissions.md) for detailed privilege requirements.\n\n## Security Audit Dimensions\n\n| Dimension | Tool | Checks |\n|-----------|------|--------|\n| Network Security | ccloud | IP allowlists, private endpoints |\n| Authentication & SSO | ccloud + sql | Cloud Console SSO, Database SSO (Cluster SSO), SCIM 2.0 provisioning, auto user provisioning |\n| Authorization | sql | Users, roles, admin grants, PUBLIC privileges |\n| Encryption | ccloud + sql | CMEK status, TLS settings |\n| Audit Logging | sql | Audit log config, session logging |\n| Backup & Recovery | ccloud + sql | Managed backup status, self-managed backup schedules |\n| Cryptographic Posture | sql + openssl + sslyze | TLS version, PQC hybrid cipher support, encryption key size |\n| Cluster Context | ccloud + user input | Deployment model, environment, compliance, data sensitivity |\n| Cluster Configuration | ccloud | Version, plan, regions |\n\n## Assessment Workflow\n\n### Step 0: Verify Prerequisites\n\nRun the following checks to determine which tools are available. The audit proceeds regardless — missing tools degrade specific checks rather than blocking the audit.\n\n**Cloud clusters:**\n```bash\n# Verify ccloud authentication\nccloud auth whoami\n\n# Verify cluster access\nccloud cluster list -o json\n```\n\n**Both deployment models:**\n```bash\n# Verify SQL connectivity\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT current_user();\"\n\n# Check openssl version (v3+ recommended for PQC probes)\nopenssl version\n\n# Check sslyze availability\nwhich sslyze && sslyze --version\n```\n\n**Report tool availability before proceeding:**\n\n| Tool | Status | Impact if Missing |\n|------|--------|-------------------|\n| `ccloud` | Available \u002F Missing | Network, CMEK, and managed backup checks skipped (Cloud only) |\n| `cockroach sql` | Available \u002F Missing | **All SQL-based checks skipped** — audit severely limited |\n| `openssl` (v3+) | Available \u002F Missing | TLS cipher and PQC probing degraded |\n| `sslyze` | Available \u002F Missing | Comprehensive TLS enumeration unavailable; falls back to `openssl` |\n\nIf `cockroach sql` is unavailable, warn the user that the audit will be limited to `ccloud`-only checks and recommend resolving connectivity before continuing. For missing optional tools (`openssl`, `sslyze`), note which checks will produce incomplete results and proceed.\n\n### Step 1: Gather Cluster Metadata and Confirm Audit Context\n\n**Cloud clusters:**\n```bash\n# List clusters and identify target\nccloud cluster list -o json\n\n# Get cluster details (use cluster name or ID)\nccloud cluster info \u003Ccluster-name> -o json\n```\n\n**Self-hosted clusters:**\n```bash\n# Gather metadata via SQL and cockroach CLI\ncockroach node status --certs-dir=\u003Ccerts-dir> --host=\u003Chost>\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT version();\"\n```\n\nRecord: cluster ID, plan type (Basic\u002FStandard\u002FAdvanced or self-hosted), cloud provider, regions, CockroachDB version. See [ccloud commands reference](references\u002Fccloud-commands.md) for Cloud CLI syntax.\n\n**Confirm audit context:** Present auto-detected metadata (cluster name, version, provider, regions, plan) and ask the user to confirm and provide:\n\n1. **Deployment model:** CockroachDB Cloud \u002F self-hosted\n2. **Environment:** production \u002F staging \u002F development \u002F sandbox\n3. **Compliance frameworks:** SOC 2, HIPAA, PCI DSS, ISO 27001, GDPR, or none\n4. **Data sensitivity:** PII\u002FPHI, financial\u002Fpayment, internal business, public\u002Fnon-sensitive\n\n**Defaults** (if user confirms without changes): Cloud, production, no compliance, internal business data. Deployment model determines check applicability (below). Environment and compliance calibrate severity (see Severity Adjustments).\n\n### Check Applicability by Deployment Model\n\n| Check | Cloud | Self-Hosted |\n|-------|-------|-------------|\n| IP allowlists (ccloud) | Yes (all tiers) | N\u002FA — managed externally via firewall\u002FVPC |\n| Ingress Private Endpoints (ccloud) | Yes (Standard+, Advanced) | N\u002FA |\n| Egress Private Endpoints (ccloud) | Yes (Advanced) | N\u002FA |\n| HBA configuration (SQL) | Yes | Yes — primary network-level auth control |\n| Cloud Console SSO | Yes | N\u002FA |\n| SCIM 2.0 | Yes | N\u002FA |\n| Database SSO (OIDC) | Yes | Yes |\n| Database SSO (LDAP\u002FAD) | Yes | Yes |\n| Users & Roles (SQL) | Yes | Yes |\n| Privileges (SQL) | Yes | Yes |\n| CMEK (ccloud) | Yes | N\u002FA — check Enterprise Encryption instead |\n| Enterprise Encryption | N\u002FA | Yes — verify encryption-at-rest via store config |\n| TLS | Always PASS (enforced) | Check — verify certs, expiry, config |\n| TLS 1.3 \u002F PQC \u002F Key Size | Yes (INFO) | Yes (INFO) |\n| Audit Logging (SQL) | Yes | Yes |\n| Managed Backups (ccloud) | Yes (automatic) | N\u002FA |\n| Self-Managed Backups (SQL) | Optional (if managed backups present) | Yes — verify backup schedules exist and are running |\n\nSkip N\u002FA checks for the detected deployment model and mark them as `[N\u002FA]` in the report rather than PASS\u002FFAIL.\n\n### Step 2: Assess Network Security\n\n**Cloud clusters:** Check all three layers based on cluster tier:\n\n```bash\n# IP allowlists (all tiers)\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n\n# Ingress private endpoints (Standard+, Advanced) — via Cloud Console or API\n# Cloud Console: Networking > Private endpoint tab\n# API: GET \u002Fapi\u002Fv1\u002Fclusters\u002F{cluster_id}\u002Fnetworking\u002Fprivate-endpoint-connections\n\n# Egress private endpoints (Advanced only) — via Cloud Console or API\n# Cloud Console: Networking > Egress tab\n# API: GET \u002Fapi\u002Fv1\u002Fclusters\u002F{cluster_id}\u002Fnetworking\u002Fegress-endpoints\n```\n\n```sql\n-- HBA configuration (all tiers)\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n```\n\n**Evaluate (Cloud):**\n- **FAIL** if `0.0.0.0\u002F0` is in the IP allowlist (open to all traffic)\n- **WARN** if allowlist contains broad CIDR ranges (e.g., `\u002F8` or `\u002F16`)\n- **WARN** if no private endpoints configured on Advanced plan\n- **INFO** if private endpoints not available on current tier\n- **PASS** if allowlist contains only specific, narrow CIDR ranges or private endpoints are configured\n\n**Self-hosted clusters:** Check HBA configuration as the primary network-level auth control:\n\n```sql\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n```\n\n**Evaluate (self-hosted):**\n- **WARN** if HBA configuration is empty or default — network security may be managed externally (firewalls, security groups, VPCs), so this is WARN not FAIL\n- **PASS** if HBA rules restrict connections by IP, subnet, or auth method\n\n### Step 3: Check SSO and SCIM Configuration\n\n> For self-hosted clusters, skip Cloud Console SSO and SCIM checks (N\u002FA). Database SSO checks still apply — check OIDC and\u002For LDAP\u002FAD configuration.\n\n**Cloud Console SSO** (Cloud Console UI > Organization Settings > Authentication — not via ccloud CLI):\n- **FAIL** if SSO is not configured\n- **PASS** if SAML or OIDC SSO is enabled and enforced\n\n**Database SSO (Cluster SSO) — OIDC:**\n```sql\n-- Check if Cluster SSO is enabled for SQL authentication\nSHOW CLUSTER SETTING server.oidc_authentication.enabled;\nSHOW CLUSTER SETTING server.oidc_authentication.provider_url;\n```\n- **FAIL** if `server.oidc_authentication.enabled` is `false`\n- **PASS** if enabled with a valid provider URL\n\n**Database SSO — LDAP\u002FAD (Cloud and self-hosted):**\n```sql\n-- Check if LDAP authentication is configured via HBA\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n-- Look for ldap auth method entries in the HBA configuration\n```\n- **PASS** if HBA contains entries with `ldap` auth method\n- **INFO** if LDAP is not configured (OIDC may be used instead)\n\n**SCIM 2.0** (Cloud Console UI > Organization Settings > Authentication > SCIM):\n- **FAIL** if SCIM endpoint is not enabled; **PASS** if enabled and connected to an IdP\n\n**Auto user provisioning on Database:**\n```sql\n-- Check if SQL users are automatically provisioned from SSO identities\nSHOW CLUSTER SETTING server.identity_map.configuration;\n```\n- **FAIL** if identity mapping is not configured\n- **PASS** if identity mapping routes IdP identities to SQL users\n\n### Step 4: Audit Users and Roles\n\n```sql\n-- List all users and their roles\nSELECT\n  username,\n  options,\n  member_of\nFROM [SHOW USERS]\nORDER BY username;\n```\n\nSee [SQL queries reference](references\u002Fsql-queries.md) for additional role audit queries.\n\n### Step 5: Check Privileges\n\n```sql\n-- Count admin role members\nSELECT COUNT(*) AS admin_count\nFROM [SHOW GRANTS ON ROLE admin];\n\n-- Check PUBLIC role privileges on the current database\n-- Note: SHOW GRANTS FOR public is scoped to the current database.\n-- Run this query from each application database to get full coverage.\nSELECT\n  database_name,\n  schema_name,\n  object_name,\n  object_type,\n  privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public'\nORDER BY database_name, object_name;\n```\n\n**Important:** `SHOW GRANTS FOR public` is scoped to the current database. Run `SHOW DATABASES;` and repeat the query from each database for full coverage.\n\n**Evaluate:**\n- **FAIL** if more than 5 users have admin role\n- **FAIL** if PUBLIC has SELECT, INSERT, UPDATE, or DELETE on application tables\n- **WARN** if admin count is between 3 and 5\n- **PASS** if admin count is 1-2 and PUBLIC has minimal grants\n\n### Step 6: Verify Encryption\n\n**CMEK status (Cloud clusters):**\n```bash\n# Check CMEK configuration (Advanced plan with Advanced Security Add-on)\nccloud cluster info \u003Ccluster-name> -o json\n# Look for cmek_config in the output\n```\n\n**Evaluate by plan type (Cloud):**\n- **Standard plan:** INFO — \"Upgrade to Advanced plan with Advanced Security Add-on to enable CMEK\"\n- **Advanced plan without Advanced Security Add-on:** INFO — \"Add Advanced Security Add-on to enable CMEK\"\n- **Advanced plan with Advanced Security Add-on, CMEK not enabled:** FAIL — CMEK not enabled despite plan supporting it\n- **Advanced plan with Advanced Security Add-on, CMEK enabled:** PASS\n\n**Enterprise Encryption (self-hosted — skip CMEK, check this instead):**\n\nEnterprise Encryption-at-Rest is configured at node start via the\n`--enterprise-encryption` flag and is not exposed as a SQL cluster setting.\nConfirm it by:\n- Inspecting the node's startup arguments (process command line \u002F systemd unit\n  \u002F Kubernetes pod spec) for `--enterprise-encryption=...`\n- Checking the per-node Prometheus endpoint:\n  `curl -ks https:\u002F\u002F\u003Cnode>:8080\u002F_status\u002Fvars | grep '^rocksdb_encryption_'`\n- The DB Console **Advanced Debug** → **Stores** view reports the active\n  encryption type per store\n\n- **FAIL** if not enabled and cluster stores sensitive data\n- **WARN** if encryption status cannot be determined\n- **PASS** if enabled with AES-256\n\n**TLS (Cloud):** Always PASS — enforced on all connections.\n\n**TLS (self-hosted):** Verify certificate validity and expiry (NOT auto-PASS):\n```bash\ncockroach cert list --certs-dir=\u003Ccerts-dir>\nopenssl x509 -in \u003Ccerts-dir>\u002Fnode.crt -noout -enddate\n```\n- **FAIL** if any certificate expires within 30 days\n- **WARN** if any certificate expires within 90 days\n- **PASS** if all certificates valid with 90+ days remaining\n\n**Remediation (self-hosted):** [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md)\n\n**Cryptographic posture (both Cloud and self-hosted — informational only):**\n```bash\n# Primary: sslyze with STARTTLS postgres (if available)\nsslyze \u003Chost>:26257 --starttls postgres\n\n# Supplementary: openssl with STARTTLS postgres\nopenssl s_client -connect \u003Chost>:26257 -starttls postgres -showcerts -tlsextdebug 2>&1\n\n# PQC probe: offer ML-KEM hybrid, check if server accepts\nopenssl s_client -connect \u003Chost>:26257 -starttls postgres -groups X25519MLKEM768:x25519 2>&1\n```\n- **INFO** — TLS version (should be TLS 1.3; note if TLS 1.2 only)\n- **INFO** — PQC hybrid cipher support (e.g., X25519MLKEM768) — emerging, not yet a FAIL condition\n- **INFO** — Encryption key size (check for AES-256; note if AES-128)\n\n> **Note:** CockroachDB uses PostgreSQL wire protocol, so `openssl s_client` requires `-starttls postgres` to negotiate TLS correctly. Without this flag, the connection will fail. `sslyze` similarly requires `--starttls postgres`.\n\n### Step 7: Check Audit Logging\n\n```sql\n-- Check audit log configuration\nSHOW CLUSTER SETTING sql.log.user_audit;\n\n-- Check admin audit logging\nSHOW CLUSTER SETTING sql.log.admin_audit.enabled;\n```\n\n**Evaluate:**\n- **FAIL** if `sql.log.user_audit` is empty and `sql.log.admin_audit.enabled` is `false`\n- **WARN** if only admin audit is enabled but user audit is not configured\n- **PASS** if both user and admin audit logging are configured\n\n### Step 8: Assess Backup Status\n\n**Cloud clusters:** Managed backups are automatic — always PASS. Optionally check for self-managed schedules:\n```bash\nccloud cluster info \u003Ccluster-name> -o json  # Look for backup_config\n```\n```sql\nSHOW SCHEDULES;  -- Check for additional self-managed backup schedules\n```\n\n**Self-hosted clusters:** No managed backups — verify self-managed backup schedules:\n```sql\nSHOW SCHEDULES;\nSELECT id, label, schedule_status, next_run, created\nFROM [SHOW SCHEDULES]\nWHERE label ILIKE '%backup%' OR command @> '{\"backup\":{}}';\n```\n- **FAIL** if no backup schedules exist\n- **WARN** if schedules exist but show errors or haven't run recently\n- **PASS** if schedules are active and running\n\n**Remediation (self-hosted):**\n```sql\nCREATE SCHEDULE 'nightly-full-backup'\n  FOR BACKUP INTO 'gs:\u002F\u002Fbucket\u002Fbackups'\n  RECURRING '@daily'\n  WITH SCHEDULE OPTIONS first_run = 'now';\n```\n\n## Pass\u002FWarn\u002FFail Criteria\n\n| Check | PASS | WARN | FAIL |\n|-------|------|------|------|\n| IP Allowlist | Specific CIDRs only | Broad ranges (\u002F8, \u002F16) | `0.0.0.0\u002F0` present |\n| Cloud Console SSO | SSO enabled + enforced | SSO enabled, not enforced | Not configured |\n| Database SSO | Cluster SSO enabled | — | Not configured |\n| SCIM 2.0 | SCIM enabled + connected | — | Not enabled |\n| DB Auto User Provisioning | Identity mapping configured | — | Not configured |\n| Admin Users | 1-2 admins | 3-5 admins | 6+ admins |\n| PUBLIC Privileges | No data grants | USAGE-only grants | SELECT\u002FINSERT\u002FUPDATE\u002FDELETE |\n| CMEK (Standard) | N\u002FA | — | — (INFO: upgrade path) |\n| CMEK (Advanced + Security Add-on) | CMEK enabled | — | Not enabled |\n| Enterprise Encryption (self-hosted) | AES-256 enabled | Cannot determine | Not enabled (sensitive data) |\n| TLS (self-hosted) | Certs valid 90+ days | Certs expire in 30-90 days | Certs expire within 30 days |\n| TLS 1.3 \u002F PQC \u002F Key Size | — | — | — (INFO only) |\n| HBA (self-hosted) | Restrictive rules | Empty\u002Fdefault | — |\n| Audit Logging | User + admin audit on | Admin audit only | Disabled |\n| Password Policy | min length >= 12 | min length 8-11 | min length \u003C 8 |\n| Backups (Cloud) | N\u002FA | — | — (INFO: managed) |\n| Backups (self-hosted) | Schedules active | Schedules have errors | No schedules exist |\n\n## Severity Adjustments by Environment\n\nSeverity is calibrated for production by default. Non-production environments downgrade some findings. Compliance requirements override downgrades.\n\n| Check | Production | Staging | Development | Sandbox |\n|-------|-----------|---------|-------------|---------|\n| IP allowlist `0.0.0.0\u002F0` (Cloud) | FAIL | FAIL | WARN | WARN |\n| No private endpoints on Advanced (Cloud) | WARN | WARN | INFO | INFO |\n| Empty HBA conf (self-hosted) | WARN | WARN | INFO | INFO |\n| SSO not configured | FAIL | FAIL | INFO | INFO |\n| SCIM not enabled | FAIL | FAIL | INFO | INFO |\n| Database SSO disabled | FAIL | FAIL | INFO | INFO |\n| Admin count 6+ | FAIL | FAIL | WARN | WARN |\n| CMEK not enabled (Cloud) | FAIL | FAIL | WARN | WARN |\n| Enterprise Encryption not enabled (self-hosted) | FAIL | FAIL | WARN | WARN |\n| Audit logging disabled | FAIL | FAIL | WARN | INFO |\n| No backup schedules (self-hosted) | FAIL | FAIL | WARN | INFO |\n\n**Compliance overrides** — these checks cannot be downgraded when a compliance framework is specified (compliance takes precedence over environment):\n\n| Framework | Non-Downgradable Checks |\n|-----------|------------------------|\n| SOC 2 | SSO, audit logging, admin users, password policy |\n| HIPAA | SSO, CMEK\u002FEnterprise Encryption, audit logging, encryption, password policy, backups |\n| PCI DSS | IP allowlist\u002FHBA, CMEK\u002FEnterprise Encryption, audit logging, admin users, password policy, backups |\n| ISO 27001 | SSO, audit logging, admin users |\n| GDPR | Audit logging, encryption |\n\n**Annotations:** `*(downgraded from FAIL — development cluster)*` or `*(PCI DSS compliance — cannot downgrade)*`\n\n## Report Format\n\nSave each audit report to `reports\u002Fsecurity-audit-\u003Ccluster-name>-\u003CYYYY-MM-DD>-\u003Csequence>.md` (gitignored, local-only). The `reports\u002F` directory is not committed to version control — it serves as a local log for historical comparison and remediation tracking.\n\nGenerate a markdown report with the following structure:\n\n```\n# Security Audit Report — \u003CCluster Name>\n\n**Date:** YYYY-MM-DD\n**Cluster ID:** \u003Ccluster-id>\n**Plan:** Standard | Advanced | Self-hosted\n**CockroachDB Version:** vXX.X.X\n**Regions:** us-east-1, us-west-2\n**Deployment:** CockroachDB Cloud | Self-hosted\n**Environment:** production | staging | development | sandbox\n**Compliance:** SOC 2, PCI DSS | (none specified)\n**Data Sensitivity:** PII\u002FPHI | financial | internal | public\n\n## Summary\n\n| Status | Count |\n|--------|-------|\n| PASS   | X     |\n| WARN   | X     |\n| FAIL   | X     |\n| INFO   | X     |\n| N\u002FA    | X     |\n\n## Findings\n\n### Network Security\n- [PASS|WARN|FAIL|N\u002FA] IP allowlist: \u003Cdetails>\n- [PASS|WARN|INFO|N\u002FA] Private endpoints: \u003Cdetails>\n- [PASS|WARN|N\u002FA] HBA configuration: \u003Cdetails>\n\n### Authentication & SSO\n- [PASS|FAIL|N\u002FA] Cloud Console SSO: \u003Cdetails>\n- [PASS|FAIL] Database SSO (OIDC): \u003Cdetails>\n- [PASS|INFO] Database SSO (LDAP\u002FAD): \u003Cdetails>\n- [PASS|FAIL|N\u002FA] SCIM 2.0 provisioning: \u003Cdetails>\n- [PASS|FAIL] Auto user provisioning: \u003Cdetails>\n\n### Authorization\n- [PASS|WARN|FAIL] Admin user count: X users with admin role\n- [PASS|FAIL] PUBLIC role privileges: \u003Cdetails>\n\n### Encryption\n- [PASS|FAIL|INFO|N\u002FA] CMEK: \u003Cdetails>\n- [PASS|FAIL|WARN|N\u002FA] Enterprise Encryption: \u003Cdetails>\n- [PASS|FAIL|N\u002FA] TLS: \u003Cdetails>\n- [INFO] Cryptographic posture: TLS version, PQC support, key size\n\n### Audit Logging\n- [PASS|WARN|FAIL] Audit log configuration: \u003Cdetails>\n\n### Backup & Recovery\n- [PASS|INFO|N\u002FA] Managed backups: \u003Cdetails>\n- [PASS|WARN|FAIL|N\u002FA] Self-managed backups: \u003Cdetails>\n\n### Cluster Configuration\n- [INFO] Version: vXX.X.X\n- [INFO] Plan: Standard | Advanced | Self-hosted\n- [INFO] Regions: \u003Clist>\n```\n\n**Status markers:** `[PASS]`, `[WARN]`, `[FAIL]`, `[INFO]`, `[N\u002FA]`. Use `[N\u002FA]` for checks that don't apply to the deployment model. Append severity adjustment annotations when applicable (see Severity Adjustments).\n\n## Remediation\n\nFor each finding, the corresponding remediation skill can be used independently:\n\n| Finding | Remediation Skill |\n|---------|------------------|\n| Open IP allowlist | [configuring-ip-allowlists](..\u002Fconfiguring-ip-allowlists\u002FSKILL.md) |\n| SSO not configured \u002F SCIM not enabled | [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) |\n| CMEK not enabled | [enabling-cmek-encryption](..\u002Fenabling-cmek-encryption\u002FSKILL.md) |\n| Audit logging disabled | [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md) |\n| Excessive admin privileges | [hardening-user-privileges](..\u002Fhardening-user-privileges\u002FSKILL.md) |\n| Weak password policy | [enforcing-password-policies](..\u002Fenforcing-password-policies\u002FSKILL.md) |\n| TLS\u002Fcertificate issues | [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md) |\n| No private connectivity | [configuring-private-connectivity](..\u002Fconfiguring-private-connectivity\u002FSKILL.md) |\n| Log export not configured | [configuring-log-export](..\u002Fconfiguring-log-export\u002FSKILL.md) |\n| Compliance gaps | [preparing-compliance-documentation](..\u002Fpreparing-compliance-documentation\u002FSKILL.md) |\n\nFor each FAIL finding, offer: **\"Explain how to fix this\"** (step-by-step guidance) or **\"Help me fix this now\"** (interactive remediation).\n\n## Safety Considerations\n\n- **All operations are read-only.** No cluster settings, users, roles, or network configurations are modified during the audit.\n- **SQL queries use SHOW and SELECT only.** No DDL or DML statements are executed.\n- **ccloud commands are read-only.** Only `list`, `info`, and `auth` subcommands are used.\n- **No secrets are logged.** Connection strings and tokens are not included in the report output.\n- **Privilege check:** The audit may produce incomplete results if the executing user lacks admin or VIEWACTIVITY privilege. The report notes any permission gaps.\n\n## References\n\n**Skill references:**\n- [Sample audit report](references\u002Fsample-report.md) — Example report with findings and remediation links\n- [SQL queries for security auditing](references\u002Fsql-queries.md)\n- [ccloud CLI commands](references\u002Fccloud-commands.md)\n- [RBAC and privileges setup](references\u002Fpermissions.md)\n\n**Remediation skills:**\n- [configuring-ip-allowlists](..\u002Fconfiguring-ip-allowlists\u002FSKILL.md) — Network access hardening\n- [enabling-cmek-encryption](..\u002Fenabling-cmek-encryption\u002FSKILL.md) — Customer-managed encryption keys\n- [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md) — SQL audit logging\n- [hardening-user-privileges](..\u002Fhardening-user-privileges\u002FSKILL.md) — RBAC tightening\n- [enforcing-password-policies](..\u002Fenforcing-password-policies\u002FSKILL.md) — Password strength enforcement\n- [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) — SSO and SCIM provisioning\n- [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md) — TLS certificate management\n- [configuring-private-connectivity](..\u002Fconfiguring-private-connectivity\u002FSKILL.md) — Private endpoints and VPC peering\n- [configuring-log-export](..\u002Fconfiguring-log-export\u002FSKILL.md) — Log and metric export\n- [preparing-compliance-documentation](..\u002Fpreparing-compliance-documentation\u002FSKILL.md) — Compliance readiness and documentation\n\n**Official CockroachDB Documentation:**\n- [CockroachDB Cloud Security Overview](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fsecurity-overview.html)\n- [Managing IP Allowlists](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html)\n- [Cloud Console SSO](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcloud-org-sso.html)\n- [Cluster SSO (Database SSO)](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-sql.html)\n- [SCIM Provisioning](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fconfigure-scim-provisioning)\n- [CMEK Overview](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcmek.html)\n- [Audit Logging](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsql-audit-logging.html)\n- [Security Reference: Authorization](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthorization.html)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Requires ccloud CLI authenticated via `ccloud auth login` and SQL access via cockroach sql with admin or VIEWACTIVITY privilege.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,55,61,72,79,109,115,123,285,293,424,438,444,627,633,640,645,653,741,749,890,898,1016,1049,1055,1062,1160,1168,1282,1295,1305,1349,1359,1365,1676,1689,1695,1704,1834,1858,1866,1941,1950,1963,1971,1992,1998,2007,2016,2037,2045,2076,2110,2118,2148,2177,2186,2204,2212,2235,2256,2262,2325,2337,2343,2491,2517,2525,2564,2570,2578,2640,2648,2691,2699,2712,2783,2793,2803,2892,2922,2937,2945,3149,3179,3221,3227,3273,3280,3329,3335,3344,3396,3410,3419,3458,3488,3495,3534,3540,3947,3953,3958,4265,4275,4362,4384,4390,4411,4416,4426,4477,4483,4488,4677,4696,4702,4778,4784,4792,4830,4838,4931,4939,5021],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Auditing Cloud Cluster Security",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Assesses the security posture of a CockroachDB Cloud cluster by examining network access controls, authentication and SSO configuration, user authorization, encryption, audit logging, and backup status. Produces a structured PASS\u002FWARN\u002FFAIL report with remediation links for each finding. Supports both CockroachDB Cloud and self-hosted clusters — checks that don't apply to the deployment model are marked N\u002FA.",{"type":48,"tag":56,"props":62,"children":63},{},[64,70],{"type":48,"tag":65,"props":66,"children":67},"strong",{},[68],{"type":53,"value":69},"Read-only audit:",{"type":53,"value":71}," All operations are read-only. No cluster state is modified during the assessment.",{"type":48,"tag":73,"props":74,"children":76},"h2",{"id":75},"when-to-use-this-skill",[77],{"type":53,"value":78},"When to Use This Skill",{"type":48,"tag":80,"props":81,"children":82},"ul",{},[83,89,94,99,104],{"type":48,"tag":84,"props":85,"children":86},"li",{},[87],{"type":53,"value":88},"Preparing for SOC 2, HIPAA, or other compliance reviews",{"type":48,"tag":84,"props":90,"children":91},{},[92],{"type":53,"value":93},"Conducting periodic security posture assessments",{"type":48,"tag":84,"props":95,"children":96},{},[97],{"type":53,"value":98},"Onboarding a new production cluster and validating security baseline",{"type":48,"tag":84,"props":100,"children":101},{},[102],{"type":53,"value":103},"Investigating security configuration gaps after an incident",{"type":48,"tag":84,"props":105,"children":106},{},[107],{"type":53,"value":108},"Reviewing cluster security before a major release or customer onboarding",{"type":48,"tag":73,"props":110,"children":112},{"id":111},"prerequisites",[113],{"type":53,"value":114},"Prerequisites",{"type":48,"tag":56,"props":116,"children":117},{},[118],{"type":48,"tag":65,"props":119,"children":120},{},[121],{"type":53,"value":122},"Tools:",{"type":48,"tag":124,"props":125,"children":126},"table",{},[127,156],{"type":48,"tag":128,"props":129,"children":130},"thead",{},[131],{"type":48,"tag":132,"props":133,"children":134},"tr",{},[135,141,146,151],{"type":48,"tag":136,"props":137,"children":138},"th",{},[139],{"type":53,"value":140},"Tool",{"type":48,"tag":136,"props":142,"children":143},{},[144],{"type":53,"value":145},"Cloud",{"type":48,"tag":136,"props":147,"children":148},{},[149],{"type":53,"value":150},"Self-Hosted",{"type":48,"tag":136,"props":152,"children":153},{},[154],{"type":53,"value":155},"Purpose",{"type":48,"tag":157,"props":158,"children":159},"tbody",{},[160,191,216,252],{"type":48,"tag":132,"props":161,"children":162},{},[163,176,181,186],{"type":48,"tag":164,"props":165,"children":166},"td",{},[167,174],{"type":48,"tag":168,"props":169,"children":171},"code",{"className":170},[],[172],{"type":53,"value":173},"ccloud",{"type":53,"value":175}," CLI",{"type":48,"tag":164,"props":177,"children":178},{},[179],{"type":53,"value":180},"Required",{"type":48,"tag":164,"props":182,"children":183},{},[184],{"type":53,"value":185},"N\u002FA",{"type":48,"tag":164,"props":187,"children":188},{},[189],{"type":53,"value":190},"Cluster metadata, network config, CMEK",{"type":48,"tag":132,"props":192,"children":193},{},[194,203,207,211],{"type":48,"tag":164,"props":195,"children":196},{},[197],{"type":48,"tag":168,"props":198,"children":200},{"className":199},[],[201],{"type":53,"value":202},"cockroach sql",{"type":48,"tag":164,"props":204,"children":205},{},[206],{"type":53,"value":180},{"type":48,"tag":164,"props":208,"children":209},{},[210],{"type":53,"value":180},{"type":48,"tag":164,"props":212,"children":213},{},[214],{"type":53,"value":215},"SQL security checks",{"type":48,"tag":132,"props":217,"children":218},{},[219,230,235,239],{"type":48,"tag":164,"props":220,"children":221},{},[222,228],{"type":48,"tag":168,"props":223,"children":225},{"className":224},[],[226],{"type":53,"value":227},"openssl",{"type":53,"value":229}," (v3+)",{"type":48,"tag":164,"props":231,"children":232},{},[233],{"type":53,"value":234},"Recommended",{"type":48,"tag":164,"props":236,"children":237},{},[238],{"type":53,"value":234},{"type":48,"tag":164,"props":240,"children":241},{},[242,244,250],{"type":53,"value":243},"TLS\u002FPQC cipher probing (",{"type":48,"tag":168,"props":245,"children":247},{"className":246},[],[248],{"type":53,"value":249},"-starttls postgres",{"type":53,"value":251},")",{"type":48,"tag":132,"props":253,"children":254},{},[255,264,269,273],{"type":48,"tag":164,"props":256,"children":257},{},[258],{"type":48,"tag":168,"props":259,"children":261},{"className":260},[],[262],{"type":53,"value":263},"sslyze",{"type":48,"tag":164,"props":265,"children":266},{},[267],{"type":53,"value":268},"Optional",{"type":48,"tag":164,"props":270,"children":271},{},[272],{"type":53,"value":268},{"type":48,"tag":164,"props":274,"children":275},{},[276,278,284],{"type":53,"value":277},"Comprehensive TLS enumeration (",{"type":48,"tag":168,"props":279,"children":281},{"className":280},[],[282],{"type":53,"value":283},"--starttls postgres",{"type":53,"value":251},{"type":48,"tag":56,"props":286,"children":287},{},[288],{"type":48,"tag":65,"props":289,"children":290},{},[291],{"type":53,"value":292},"Credentials:",{"type":48,"tag":124,"props":294,"children":295},{},[296,315],{"type":48,"tag":128,"props":297,"children":298},{},[299],{"type":48,"tag":132,"props":300,"children":301},{},[302,307,311],{"type":48,"tag":136,"props":303,"children":304},{},[305],{"type":53,"value":306},"Credential",{"type":48,"tag":136,"props":308,"children":309},{},[310],{"type":53,"value":145},{"type":48,"tag":136,"props":312,"children":313},{},[314],{"type":53,"value":150},{"type":48,"tag":157,"props":316,"children":317},{},[318,340,365,382,400],{"type":48,"tag":132,"props":319,"children":320},{},[321,332,336],{"type":48,"tag":164,"props":322,"children":323},{},[324,330],{"type":48,"tag":168,"props":325,"children":327},{"className":326},[],[328],{"type":53,"value":329},"ccloud auth login",{"type":53,"value":331}," session",{"type":48,"tag":164,"props":333,"children":334},{},[335],{"type":53,"value":180},{"type":48,"tag":164,"props":337,"children":338},{},[339],{"type":53,"value":185},{"type":48,"tag":132,"props":341,"children":342},{},[343,348,360],{"type":48,"tag":164,"props":344,"children":345},{},[346],{"type":53,"value":347},"SQL connection string",{"type":48,"tag":164,"props":349,"children":350},{},[351,353,359],{"type":53,"value":352},"Required (from ",{"type":48,"tag":168,"props":354,"children":356},{"className":355},[],[357],{"type":53,"value":358},"ccloud cluster sql --url",{"type":53,"value":251},{"type":48,"tag":164,"props":361,"children":362},{},[363],{"type":53,"value":364},"Required (user provides)",{"type":48,"tag":132,"props":366,"children":367},{},[368,373,378],{"type":48,"tag":164,"props":369,"children":370},{},[371],{"type":53,"value":372},"DB username\u002Fpassword",{"type":48,"tag":164,"props":374,"children":375},{},[376],{"type":53,"value":377},"Required (admin or VIEWACTIVITY)",{"type":48,"tag":164,"props":379,"children":380},{},[381],{"type":53,"value":377},{"type":48,"tag":132,"props":383,"children":384},{},[385,390,395],{"type":48,"tag":164,"props":386,"children":387},{},[388],{"type":53,"value":389},"TLS certificates directory",{"type":48,"tag":164,"props":391,"children":392},{},[393],{"type":53,"value":394},"N\u002FA (managed)",{"type":48,"tag":164,"props":396,"children":397},{},[398],{"type":53,"value":399},"Required for cert expiry checks",{"type":48,"tag":132,"props":401,"children":402},{},[403,408,412],{"type":48,"tag":164,"props":404,"children":405},{},[406],{"type":53,"value":407},"CA certificate file",{"type":48,"tag":164,"props":409,"children":410},{},[411],{"type":53,"value":185},{"type":48,"tag":164,"props":413,"children":414},{},[415,417,422],{"type":53,"value":416},"Required for ",{"type":48,"tag":168,"props":418,"children":420},{"className":419},[],[421],{"type":53,"value":227},{"type":53,"value":423}," TLS probing",{"type":48,"tag":56,"props":425,"children":426},{},[427,429,436],{"type":53,"value":428},"See ",{"type":48,"tag":430,"props":431,"children":433},"a",{"href":432},"references\u002Fpermissions.md",[434],{"type":53,"value":435},"permissions reference",{"type":53,"value":437}," for detailed privilege requirements.",{"type":48,"tag":73,"props":439,"children":441},{"id":440},"security-audit-dimensions",[442],{"type":53,"value":443},"Security Audit Dimensions",{"type":48,"tag":124,"props":445,"children":446},{},[447,467],{"type":48,"tag":128,"props":448,"children":449},{},[450],{"type":48,"tag":132,"props":451,"children":452},{},[453,458,462],{"type":48,"tag":136,"props":454,"children":455},{},[456],{"type":53,"value":457},"Dimension",{"type":48,"tag":136,"props":459,"children":460},{},[461],{"type":53,"value":140},{"type":48,"tag":136,"props":463,"children":464},{},[465],{"type":53,"value":466},"Checks",{"type":48,"tag":157,"props":468,"children":469},{},[470,487,505,523,540,557,574,592,610],{"type":48,"tag":132,"props":471,"children":472},{},[473,478,482],{"type":48,"tag":164,"props":474,"children":475},{},[476],{"type":53,"value":477},"Network Security",{"type":48,"tag":164,"props":479,"children":480},{},[481],{"type":53,"value":173},{"type":48,"tag":164,"props":483,"children":484},{},[485],{"type":53,"value":486},"IP allowlists, private endpoints",{"type":48,"tag":132,"props":488,"children":489},{},[490,495,500],{"type":48,"tag":164,"props":491,"children":492},{},[493],{"type":53,"value":494},"Authentication & SSO",{"type":48,"tag":164,"props":496,"children":497},{},[498],{"type":53,"value":499},"ccloud + sql",{"type":48,"tag":164,"props":501,"children":502},{},[503],{"type":53,"value":504},"Cloud Console SSO, Database SSO (Cluster SSO), SCIM 2.0 provisioning, auto user provisioning",{"type":48,"tag":132,"props":506,"children":507},{},[508,513,518],{"type":48,"tag":164,"props":509,"children":510},{},[511],{"type":53,"value":512},"Authorization",{"type":48,"tag":164,"props":514,"children":515},{},[516],{"type":53,"value":517},"sql",{"type":48,"tag":164,"props":519,"children":520},{},[521],{"type":53,"value":522},"Users, roles, admin grants, PUBLIC privileges",{"type":48,"tag":132,"props":524,"children":525},{},[526,531,535],{"type":48,"tag":164,"props":527,"children":528},{},[529],{"type":53,"value":530},"Encryption",{"type":48,"tag":164,"props":532,"children":533},{},[534],{"type":53,"value":499},{"type":48,"tag":164,"props":536,"children":537},{},[538],{"type":53,"value":539},"CMEK status, TLS settings",{"type":48,"tag":132,"props":541,"children":542},{},[543,548,552],{"type":48,"tag":164,"props":544,"children":545},{},[546],{"type":53,"value":547},"Audit Logging",{"type":48,"tag":164,"props":549,"children":550},{},[551],{"type":53,"value":517},{"type":48,"tag":164,"props":553,"children":554},{},[555],{"type":53,"value":556},"Audit log config, session logging",{"type":48,"tag":132,"props":558,"children":559},{},[560,565,569],{"type":48,"tag":164,"props":561,"children":562},{},[563],{"type":53,"value":564},"Backup & Recovery",{"type":48,"tag":164,"props":566,"children":567},{},[568],{"type":53,"value":499},{"type":48,"tag":164,"props":570,"children":571},{},[572],{"type":53,"value":573},"Managed backup status, self-managed backup schedules",{"type":48,"tag":132,"props":575,"children":576},{},[577,582,587],{"type":48,"tag":164,"props":578,"children":579},{},[580],{"type":53,"value":581},"Cryptographic Posture",{"type":48,"tag":164,"props":583,"children":584},{},[585],{"type":53,"value":586},"sql + openssl + sslyze",{"type":48,"tag":164,"props":588,"children":589},{},[590],{"type":53,"value":591},"TLS version, PQC hybrid cipher support, encryption key size",{"type":48,"tag":132,"props":593,"children":594},{},[595,600,605],{"type":48,"tag":164,"props":596,"children":597},{},[598],{"type":53,"value":599},"Cluster Context",{"type":48,"tag":164,"props":601,"children":602},{},[603],{"type":53,"value":604},"ccloud + user input",{"type":48,"tag":164,"props":606,"children":607},{},[608],{"type":53,"value":609},"Deployment model, environment, compliance, data sensitivity",{"type":48,"tag":132,"props":611,"children":612},{},[613,618,622],{"type":48,"tag":164,"props":614,"children":615},{},[616],{"type":53,"value":617},"Cluster Configuration",{"type":48,"tag":164,"props":619,"children":620},{},[621],{"type":53,"value":173},{"type":48,"tag":164,"props":623,"children":624},{},[625],{"type":53,"value":626},"Version, plan, regions",{"type":48,"tag":73,"props":628,"children":630},{"id":629},"assessment-workflow",[631],{"type":53,"value":632},"Assessment Workflow",{"type":48,"tag":634,"props":635,"children":637},"h3",{"id":636},"step-0-verify-prerequisites",[638],{"type":53,"value":639},"Step 0: Verify Prerequisites",{"type":48,"tag":56,"props":641,"children":642},{},[643],{"type":53,"value":644},"Run the following checks to determine which tools are available. The audit proceeds regardless — missing tools degrade specific checks rather than blocking the audit.",{"type":48,"tag":56,"props":646,"children":647},{},[648],{"type":48,"tag":65,"props":649,"children":650},{},[651],{"type":53,"value":652},"Cloud clusters:",{"type":48,"tag":654,"props":655,"children":660},"pre",{"className":656,"code":657,"language":658,"meta":659,"style":659},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Verify ccloud authentication\nccloud auth whoami\n\n# Verify cluster access\nccloud cluster list -o json\n","bash","",[661],{"type":48,"tag":168,"props":662,"children":663},{"__ignoreMap":659},[664,676,695,704,713],{"type":48,"tag":665,"props":666,"children":669},"span",{"class":667,"line":668},"line",1,[670],{"type":48,"tag":665,"props":671,"children":673},{"style":672},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[674],{"type":53,"value":675},"# Verify ccloud authentication\n",{"type":48,"tag":665,"props":677,"children":678},{"class":667,"line":29},[679,684,690],{"type":48,"tag":665,"props":680,"children":682},{"style":681},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[683],{"type":53,"value":173},{"type":48,"tag":665,"props":685,"children":687},{"style":686},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[688],{"type":53,"value":689}," auth",{"type":48,"tag":665,"props":691,"children":692},{"style":686},[693],{"type":53,"value":694}," whoami\n",{"type":48,"tag":665,"props":696,"children":697},{"class":667,"line":25},[698],{"type":48,"tag":665,"props":699,"children":701},{"emptyLinePlaceholder":700},true,[702],{"type":53,"value":703},"\n",{"type":48,"tag":665,"props":705,"children":707},{"class":667,"line":706},4,[708],{"type":48,"tag":665,"props":709,"children":710},{"style":672},[711],{"type":53,"value":712},"# Verify cluster access\n",{"type":48,"tag":665,"props":714,"children":716},{"class":667,"line":715},5,[717,721,726,731,736],{"type":48,"tag":665,"props":718,"children":719},{"style":681},[720],{"type":53,"value":173},{"type":48,"tag":665,"props":722,"children":723},{"style":686},[724],{"type":53,"value":725}," cluster",{"type":48,"tag":665,"props":727,"children":728},{"style":686},[729],{"type":53,"value":730}," list",{"type":48,"tag":665,"props":732,"children":733},{"style":686},[734],{"type":53,"value":735}," -o",{"type":48,"tag":665,"props":737,"children":738},{"style":686},[739],{"type":53,"value":740}," json\n",{"type":48,"tag":56,"props":742,"children":743},{},[744],{"type":48,"tag":65,"props":745,"children":746},{},[747],{"type":53,"value":748},"Both deployment models:",{"type":48,"tag":654,"props":750,"children":752},{"className":656,"code":751,"language":658,"meta":659,"style":659},"# Verify SQL connectivity\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT current_user();\"\n\n# Check openssl version (v3+ recommended for PQC probes)\nopenssl version\n\n# Check sslyze availability\nwhich sslyze && sslyze --version\n",[753],{"type":48,"tag":168,"props":754,"children":755},{"__ignoreMap":659},[756,764,817,824,832,844,852,861],{"type":48,"tag":665,"props":757,"children":758},{"class":667,"line":668},[759],{"type":48,"tag":665,"props":760,"children":761},{"style":672},[762],{"type":53,"value":763},"# Verify SQL connectivity\n",{"type":48,"tag":665,"props":765,"children":766},{"class":667,"line":29},[767,772,777,782,788,793,798,803,807,812],{"type":48,"tag":665,"props":768,"children":769},{"style":681},[770],{"type":53,"value":771},"cockroach",{"type":48,"tag":665,"props":773,"children":774},{"style":686},[775],{"type":53,"value":776}," sql",{"type":48,"tag":665,"props":778,"children":779},{"style":686},[780],{"type":53,"value":781}," --url",{"type":48,"tag":665,"props":783,"children":785},{"style":784},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[786],{"type":53,"value":787}," \"",{"type":48,"tag":665,"props":789,"children":790},{"style":686},[791],{"type":53,"value":792},"\u003Cconnection-string>",{"type":48,"tag":665,"props":794,"children":795},{"style":784},[796],{"type":53,"value":797},"\"",{"type":48,"tag":665,"props":799,"children":800},{"style":686},[801],{"type":53,"value":802}," -e",{"type":48,"tag":665,"props":804,"children":805},{"style":784},[806],{"type":53,"value":787},{"type":48,"tag":665,"props":808,"children":809},{"style":686},[810],{"type":53,"value":811},"SELECT current_user();",{"type":48,"tag":665,"props":813,"children":814},{"style":784},[815],{"type":53,"value":816},"\"\n",{"type":48,"tag":665,"props":818,"children":819},{"class":667,"line":25},[820],{"type":48,"tag":665,"props":821,"children":822},{"emptyLinePlaceholder":700},[823],{"type":53,"value":703},{"type":48,"tag":665,"props":825,"children":826},{"class":667,"line":706},[827],{"type":48,"tag":665,"props":828,"children":829},{"style":672},[830],{"type":53,"value":831},"# Check openssl version (v3+ recommended for PQC probes)\n",{"type":48,"tag":665,"props":833,"children":834},{"class":667,"line":715},[835,839],{"type":48,"tag":665,"props":836,"children":837},{"style":681},[838],{"type":53,"value":227},{"type":48,"tag":665,"props":840,"children":841},{"style":686},[842],{"type":53,"value":843}," version\n",{"type":48,"tag":665,"props":845,"children":847},{"class":667,"line":846},6,[848],{"type":48,"tag":665,"props":849,"children":850},{"emptyLinePlaceholder":700},[851],{"type":53,"value":703},{"type":48,"tag":665,"props":853,"children":855},{"class":667,"line":854},7,[856],{"type":48,"tag":665,"props":857,"children":858},{"style":672},[859],{"type":53,"value":860},"# Check sslyze availability\n",{"type":48,"tag":665,"props":862,"children":864},{"class":667,"line":863},8,[865,871,876,881,885],{"type":48,"tag":665,"props":866,"children":868},{"style":867},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[869],{"type":53,"value":870},"which",{"type":48,"tag":665,"props":872,"children":873},{"style":686},[874],{"type":53,"value":875}," sslyze",{"type":48,"tag":665,"props":877,"children":878},{"style":784},[879],{"type":53,"value":880}," &&",{"type":48,"tag":665,"props":882,"children":883},{"style":681},[884],{"type":53,"value":875},{"type":48,"tag":665,"props":886,"children":887},{"style":686},[888],{"type":53,"value":889}," --version\n",{"type":48,"tag":56,"props":891,"children":892},{},[893],{"type":48,"tag":65,"props":894,"children":895},{},[896],{"type":53,"value":897},"Report tool availability before proceeding:",{"type":48,"tag":124,"props":899,"children":900},{},[901,921],{"type":48,"tag":128,"props":902,"children":903},{},[904],{"type":48,"tag":132,"props":905,"children":906},{},[907,911,916],{"type":48,"tag":136,"props":908,"children":909},{},[910],{"type":53,"value":140},{"type":48,"tag":136,"props":912,"children":913},{},[914],{"type":53,"value":915},"Status",{"type":48,"tag":136,"props":917,"children":918},{},[919],{"type":53,"value":920},"Impact if Missing",{"type":48,"tag":157,"props":922,"children":923},{},[924,945,970,991],{"type":48,"tag":132,"props":925,"children":926},{},[927,935,940],{"type":48,"tag":164,"props":928,"children":929},{},[930],{"type":48,"tag":168,"props":931,"children":933},{"className":932},[],[934],{"type":53,"value":173},{"type":48,"tag":164,"props":936,"children":937},{},[938],{"type":53,"value":939},"Available \u002F Missing",{"type":48,"tag":164,"props":941,"children":942},{},[943],{"type":53,"value":944},"Network, CMEK, and managed backup checks skipped (Cloud only)",{"type":48,"tag":132,"props":946,"children":947},{},[948,956,960],{"type":48,"tag":164,"props":949,"children":950},{},[951],{"type":48,"tag":168,"props":952,"children":954},{"className":953},[],[955],{"type":53,"value":202},{"type":48,"tag":164,"props":957,"children":958},{},[959],{"type":53,"value":939},{"type":48,"tag":164,"props":961,"children":962},{},[963,968],{"type":48,"tag":65,"props":964,"children":965},{},[966],{"type":53,"value":967},"All SQL-based checks skipped",{"type":53,"value":969}," — audit severely limited",{"type":48,"tag":132,"props":971,"children":972},{},[973,982,986],{"type":48,"tag":164,"props":974,"children":975},{},[976,981],{"type":48,"tag":168,"props":977,"children":979},{"className":978},[],[980],{"type":53,"value":227},{"type":53,"value":229},{"type":48,"tag":164,"props":983,"children":984},{},[985],{"type":53,"value":939},{"type":48,"tag":164,"props":987,"children":988},{},[989],{"type":53,"value":990},"TLS cipher and PQC probing degraded",{"type":48,"tag":132,"props":992,"children":993},{},[994,1002,1006],{"type":48,"tag":164,"props":995,"children":996},{},[997],{"type":48,"tag":168,"props":998,"children":1000},{"className":999},[],[1001],{"type":53,"value":263},{"type":48,"tag":164,"props":1003,"children":1004},{},[1005],{"type":53,"value":939},{"type":48,"tag":164,"props":1007,"children":1008},{},[1009,1011],{"type":53,"value":1010},"Comprehensive TLS enumeration unavailable; falls back to ",{"type":48,"tag":168,"props":1012,"children":1014},{"className":1013},[],[1015],{"type":53,"value":227},{"type":48,"tag":56,"props":1017,"children":1018},{},[1019,1021,1026,1028,1033,1035,1040,1042,1047],{"type":53,"value":1020},"If ",{"type":48,"tag":168,"props":1022,"children":1024},{"className":1023},[],[1025],{"type":53,"value":202},{"type":53,"value":1027}," is unavailable, warn the user that the audit will be limited to ",{"type":48,"tag":168,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":53,"value":173},{"type":53,"value":1034},"-only checks and recommend resolving connectivity before continuing. For missing optional tools (",{"type":48,"tag":168,"props":1036,"children":1038},{"className":1037},[],[1039],{"type":53,"value":227},{"type":53,"value":1041},", ",{"type":48,"tag":168,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":53,"value":263},{"type":53,"value":1048},"), note which checks will produce incomplete results and proceed.",{"type":48,"tag":634,"props":1050,"children":1052},{"id":1051},"step-1-gather-cluster-metadata-and-confirm-audit-context",[1053],{"type":53,"value":1054},"Step 1: Gather Cluster Metadata and Confirm Audit Context",{"type":48,"tag":56,"props":1056,"children":1057},{},[1058],{"type":48,"tag":65,"props":1059,"children":1060},{},[1061],{"type":53,"value":652},{"type":48,"tag":654,"props":1063,"children":1065},{"className":656,"code":1064,"language":658,"meta":659,"style":659},"# List clusters and identify target\nccloud cluster list -o json\n\n# Get cluster details (use cluster name or ID)\nccloud cluster info \u003Ccluster-name> -o json\n",[1066],{"type":48,"tag":168,"props":1067,"children":1068},{"__ignoreMap":659},[1069,1077,1100,1107,1115],{"type":48,"tag":665,"props":1070,"children":1071},{"class":667,"line":668},[1072],{"type":48,"tag":665,"props":1073,"children":1074},{"style":672},[1075],{"type":53,"value":1076},"# List clusters and identify target\n",{"type":48,"tag":665,"props":1078,"children":1079},{"class":667,"line":29},[1080,1084,1088,1092,1096],{"type":48,"tag":665,"props":1081,"children":1082},{"style":681},[1083],{"type":53,"value":173},{"type":48,"tag":665,"props":1085,"children":1086},{"style":686},[1087],{"type":53,"value":725},{"type":48,"tag":665,"props":1089,"children":1090},{"style":686},[1091],{"type":53,"value":730},{"type":48,"tag":665,"props":1093,"children":1094},{"style":686},[1095],{"type":53,"value":735},{"type":48,"tag":665,"props":1097,"children":1098},{"style":686},[1099],{"type":53,"value":740},{"type":48,"tag":665,"props":1101,"children":1102},{"class":667,"line":25},[1103],{"type":48,"tag":665,"props":1104,"children":1105},{"emptyLinePlaceholder":700},[1106],{"type":53,"value":703},{"type":48,"tag":665,"props":1108,"children":1109},{"class":667,"line":706},[1110],{"type":48,"tag":665,"props":1111,"children":1112},{"style":672},[1113],{"type":53,"value":1114},"# Get cluster details (use cluster name or ID)\n",{"type":48,"tag":665,"props":1116,"children":1117},{"class":667,"line":715},[1118,1122,1126,1131,1136,1141,1147,1152,1156],{"type":48,"tag":665,"props":1119,"children":1120},{"style":681},[1121],{"type":53,"value":173},{"type":48,"tag":665,"props":1123,"children":1124},{"style":686},[1125],{"type":53,"value":725},{"type":48,"tag":665,"props":1127,"children":1128},{"style":686},[1129],{"type":53,"value":1130}," info",{"type":48,"tag":665,"props":1132,"children":1133},{"style":784},[1134],{"type":53,"value":1135}," \u003C",{"type":48,"tag":665,"props":1137,"children":1138},{"style":686},[1139],{"type":53,"value":1140},"cluster-nam",{"type":48,"tag":665,"props":1142,"children":1144},{"style":1143},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1145],{"type":53,"value":1146},"e",{"type":48,"tag":665,"props":1148,"children":1149},{"style":784},[1150],{"type":53,"value":1151},">",{"type":48,"tag":665,"props":1153,"children":1154},{"style":686},[1155],{"type":53,"value":735},{"type":48,"tag":665,"props":1157,"children":1158},{"style":686},[1159],{"type":53,"value":740},{"type":48,"tag":56,"props":1161,"children":1162},{},[1163],{"type":48,"tag":65,"props":1164,"children":1165},{},[1166],{"type":53,"value":1167},"Self-hosted clusters:",{"type":48,"tag":654,"props":1169,"children":1171},{"className":656,"code":1170,"language":658,"meta":659,"style":659},"# Gather metadata via SQL and cockroach CLI\ncockroach node status --certs-dir=\u003Ccerts-dir> --host=\u003Chost>\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT version();\"\n",[1172],{"type":48,"tag":168,"props":1173,"children":1174},{"__ignoreMap":659},[1175,1183,1238],{"type":48,"tag":665,"props":1176,"children":1177},{"class":667,"line":668},[1178],{"type":48,"tag":665,"props":1179,"children":1180},{"style":672},[1181],{"type":53,"value":1182},"# Gather metadata via SQL and cockroach CLI\n",{"type":48,"tag":665,"props":1184,"children":1185},{"class":667,"line":29},[1186,1190,1195,1200,1205,1210,1215,1219,1224,1228,1233],{"type":48,"tag":665,"props":1187,"children":1188},{"style":681},[1189],{"type":53,"value":771},{"type":48,"tag":665,"props":1191,"children":1192},{"style":686},[1193],{"type":53,"value":1194}," node",{"type":48,"tag":665,"props":1196,"children":1197},{"style":686},[1198],{"type":53,"value":1199}," status",{"type":48,"tag":665,"props":1201,"children":1202},{"style":686},[1203],{"type":53,"value":1204}," --certs-dir=",{"type":48,"tag":665,"props":1206,"children":1207},{"style":784},[1208],{"type":53,"value":1209},"\u003C",{"type":48,"tag":665,"props":1211,"children":1212},{"style":686},[1213],{"type":53,"value":1214},"certs-dir",{"type":48,"tag":665,"props":1216,"children":1217},{"style":784},[1218],{"type":53,"value":1151},{"type":48,"tag":665,"props":1220,"children":1221},{"style":686},[1222],{"type":53,"value":1223}," --host=",{"type":48,"tag":665,"props":1225,"children":1226},{"style":784},[1227],{"type":53,"value":1209},{"type":48,"tag":665,"props":1229,"children":1230},{"style":686},[1231],{"type":53,"value":1232},"host",{"type":48,"tag":665,"props":1234,"children":1235},{"style":784},[1236],{"type":53,"value":1237},">\n",{"type":48,"tag":665,"props":1239,"children":1240},{"class":667,"line":25},[1241,1245,1249,1253,1257,1261,1265,1269,1273,1278],{"type":48,"tag":665,"props":1242,"children":1243},{"style":681},[1244],{"type":53,"value":771},{"type":48,"tag":665,"props":1246,"children":1247},{"style":686},[1248],{"type":53,"value":776},{"type":48,"tag":665,"props":1250,"children":1251},{"style":686},[1252],{"type":53,"value":781},{"type":48,"tag":665,"props":1254,"children":1255},{"style":784},[1256],{"type":53,"value":787},{"type":48,"tag":665,"props":1258,"children":1259},{"style":686},[1260],{"type":53,"value":792},{"type":48,"tag":665,"props":1262,"children":1263},{"style":784},[1264],{"type":53,"value":797},{"type":48,"tag":665,"props":1266,"children":1267},{"style":686},[1268],{"type":53,"value":802},{"type":48,"tag":665,"props":1270,"children":1271},{"style":784},[1272],{"type":53,"value":787},{"type":48,"tag":665,"props":1274,"children":1275},{"style":686},[1276],{"type":53,"value":1277},"SELECT version();",{"type":48,"tag":665,"props":1279,"children":1280},{"style":784},[1281],{"type":53,"value":816},{"type":48,"tag":56,"props":1283,"children":1284},{},[1285,1287,1293],{"type":53,"value":1286},"Record: cluster ID, plan type (Basic\u002FStandard\u002FAdvanced or self-hosted), cloud provider, regions, CockroachDB version. See ",{"type":48,"tag":430,"props":1288,"children":1290},{"href":1289},"references\u002Fccloud-commands.md",[1291],{"type":53,"value":1292},"ccloud commands reference",{"type":53,"value":1294}," for Cloud CLI syntax.",{"type":48,"tag":56,"props":1296,"children":1297},{},[1298,1303],{"type":48,"tag":65,"props":1299,"children":1300},{},[1301],{"type":53,"value":1302},"Confirm audit context:",{"type":53,"value":1304}," Present auto-detected metadata (cluster name, version, provider, regions, plan) and ask the user to confirm and provide:",{"type":48,"tag":1306,"props":1307,"children":1308},"ol",{},[1309,1319,1329,1339],{"type":48,"tag":84,"props":1310,"children":1311},{},[1312,1317],{"type":48,"tag":65,"props":1313,"children":1314},{},[1315],{"type":53,"value":1316},"Deployment model:",{"type":53,"value":1318}," CockroachDB Cloud \u002F self-hosted",{"type":48,"tag":84,"props":1320,"children":1321},{},[1322,1327],{"type":48,"tag":65,"props":1323,"children":1324},{},[1325],{"type":53,"value":1326},"Environment:",{"type":53,"value":1328}," production \u002F staging \u002F development \u002F sandbox",{"type":48,"tag":84,"props":1330,"children":1331},{},[1332,1337],{"type":48,"tag":65,"props":1333,"children":1334},{},[1335],{"type":53,"value":1336},"Compliance frameworks:",{"type":53,"value":1338}," SOC 2, HIPAA, PCI DSS, ISO 27001, GDPR, or none",{"type":48,"tag":84,"props":1340,"children":1341},{},[1342,1347],{"type":48,"tag":65,"props":1343,"children":1344},{},[1345],{"type":53,"value":1346},"Data sensitivity:",{"type":53,"value":1348}," PII\u002FPHI, financial\u002Fpayment, internal business, public\u002Fnon-sensitive",{"type":48,"tag":56,"props":1350,"children":1351},{},[1352,1357],{"type":48,"tag":65,"props":1353,"children":1354},{},[1355],{"type":53,"value":1356},"Defaults",{"type":53,"value":1358}," (if user confirms without changes): Cloud, production, no compliance, internal business data. Deployment model determines check applicability (below). Environment and compliance calibrate severity (see Severity Adjustments).",{"type":48,"tag":634,"props":1360,"children":1362},{"id":1361},"check-applicability-by-deployment-model",[1363],{"type":53,"value":1364},"Check Applicability by Deployment Model",{"type":48,"tag":124,"props":1366,"children":1367},{},[1368,1387],{"type":48,"tag":128,"props":1369,"children":1370},{},[1371],{"type":48,"tag":132,"props":1372,"children":1373},{},[1374,1379,1383],{"type":48,"tag":136,"props":1375,"children":1376},{},[1377],{"type":53,"value":1378},"Check",{"type":48,"tag":136,"props":1380,"children":1381},{},[1382],{"type":53,"value":145},{"type":48,"tag":136,"props":1384,"children":1385},{},[1386],{"type":53,"value":150},{"type":48,"tag":157,"props":1388,"children":1389},{},[1390,1408,1425,1442,1460,1476,1492,1508,1524,1540,1556,1573,1590,1608,1625,1641,1658],{"type":48,"tag":132,"props":1391,"children":1392},{},[1393,1398,1403],{"type":48,"tag":164,"props":1394,"children":1395},{},[1396],{"type":53,"value":1397},"IP allowlists (ccloud)",{"type":48,"tag":164,"props":1399,"children":1400},{},[1401],{"type":53,"value":1402},"Yes (all tiers)",{"type":48,"tag":164,"props":1404,"children":1405},{},[1406],{"type":53,"value":1407},"N\u002FA — managed externally via firewall\u002FVPC",{"type":48,"tag":132,"props":1409,"children":1410},{},[1411,1416,1421],{"type":48,"tag":164,"props":1412,"children":1413},{},[1414],{"type":53,"value":1415},"Ingress Private Endpoints (ccloud)",{"type":48,"tag":164,"props":1417,"children":1418},{},[1419],{"type":53,"value":1420},"Yes (Standard+, Advanced)",{"type":48,"tag":164,"props":1422,"children":1423},{},[1424],{"type":53,"value":185},{"type":48,"tag":132,"props":1426,"children":1427},{},[1428,1433,1438],{"type":48,"tag":164,"props":1429,"children":1430},{},[1431],{"type":53,"value":1432},"Egress Private Endpoints (ccloud)",{"type":48,"tag":164,"props":1434,"children":1435},{},[1436],{"type":53,"value":1437},"Yes (Advanced)",{"type":48,"tag":164,"props":1439,"children":1440},{},[1441],{"type":53,"value":185},{"type":48,"tag":132,"props":1443,"children":1444},{},[1445,1450,1455],{"type":48,"tag":164,"props":1446,"children":1447},{},[1448],{"type":53,"value":1449},"HBA configuration (SQL)",{"type":48,"tag":164,"props":1451,"children":1452},{},[1453],{"type":53,"value":1454},"Yes",{"type":48,"tag":164,"props":1456,"children":1457},{},[1458],{"type":53,"value":1459},"Yes — primary network-level auth control",{"type":48,"tag":132,"props":1461,"children":1462},{},[1463,1468,1472],{"type":48,"tag":164,"props":1464,"children":1465},{},[1466],{"type":53,"value":1467},"Cloud Console SSO",{"type":48,"tag":164,"props":1469,"children":1470},{},[1471],{"type":53,"value":1454},{"type":48,"tag":164,"props":1473,"children":1474},{},[1475],{"type":53,"value":185},{"type":48,"tag":132,"props":1477,"children":1478},{},[1479,1484,1488],{"type":48,"tag":164,"props":1480,"children":1481},{},[1482],{"type":53,"value":1483},"SCIM 2.0",{"type":48,"tag":164,"props":1485,"children":1486},{},[1487],{"type":53,"value":1454},{"type":48,"tag":164,"props":1489,"children":1490},{},[1491],{"type":53,"value":185},{"type":48,"tag":132,"props":1493,"children":1494},{},[1495,1500,1504],{"type":48,"tag":164,"props":1496,"children":1497},{},[1498],{"type":53,"value":1499},"Database SSO (OIDC)",{"type":48,"tag":164,"props":1501,"children":1502},{},[1503],{"type":53,"value":1454},{"type":48,"tag":164,"props":1505,"children":1506},{},[1507],{"type":53,"value":1454},{"type":48,"tag":132,"props":1509,"children":1510},{},[1511,1516,1520],{"type":48,"tag":164,"props":1512,"children":1513},{},[1514],{"type":53,"value":1515},"Database SSO (LDAP\u002FAD)",{"type":48,"tag":164,"props":1517,"children":1518},{},[1519],{"type":53,"value":1454},{"type":48,"tag":164,"props":1521,"children":1522},{},[1523],{"type":53,"value":1454},{"type":48,"tag":132,"props":1525,"children":1526},{},[1527,1532,1536],{"type":48,"tag":164,"props":1528,"children":1529},{},[1530],{"type":53,"value":1531},"Users & Roles (SQL)",{"type":48,"tag":164,"props":1533,"children":1534},{},[1535],{"type":53,"value":1454},{"type":48,"tag":164,"props":1537,"children":1538},{},[1539],{"type":53,"value":1454},{"type":48,"tag":132,"props":1541,"children":1542},{},[1543,1548,1552],{"type":48,"tag":164,"props":1544,"children":1545},{},[1546],{"type":53,"value":1547},"Privileges (SQL)",{"type":48,"tag":164,"props":1549,"children":1550},{},[1551],{"type":53,"value":1454},{"type":48,"tag":164,"props":1553,"children":1554},{},[1555],{"type":53,"value":1454},{"type":48,"tag":132,"props":1557,"children":1558},{},[1559,1564,1568],{"type":48,"tag":164,"props":1560,"children":1561},{},[1562],{"type":53,"value":1563},"CMEK (ccloud)",{"type":48,"tag":164,"props":1565,"children":1566},{},[1567],{"type":53,"value":1454},{"type":48,"tag":164,"props":1569,"children":1570},{},[1571],{"type":53,"value":1572},"N\u002FA — check Enterprise Encryption instead",{"type":48,"tag":132,"props":1574,"children":1575},{},[1576,1581,1585],{"type":48,"tag":164,"props":1577,"children":1578},{},[1579],{"type":53,"value":1580},"Enterprise Encryption",{"type":48,"tag":164,"props":1582,"children":1583},{},[1584],{"type":53,"value":185},{"type":48,"tag":164,"props":1586,"children":1587},{},[1588],{"type":53,"value":1589},"Yes — verify encryption-at-rest via store config",{"type":48,"tag":132,"props":1591,"children":1592},{},[1593,1598,1603],{"type":48,"tag":164,"props":1594,"children":1595},{},[1596],{"type":53,"value":1597},"TLS",{"type":48,"tag":164,"props":1599,"children":1600},{},[1601],{"type":53,"value":1602},"Always PASS (enforced)",{"type":48,"tag":164,"props":1604,"children":1605},{},[1606],{"type":53,"value":1607},"Check — verify certs, expiry, config",{"type":48,"tag":132,"props":1609,"children":1610},{},[1611,1616,1621],{"type":48,"tag":164,"props":1612,"children":1613},{},[1614],{"type":53,"value":1615},"TLS 1.3 \u002F PQC \u002F Key Size",{"type":48,"tag":164,"props":1617,"children":1618},{},[1619],{"type":53,"value":1620},"Yes (INFO)",{"type":48,"tag":164,"props":1622,"children":1623},{},[1624],{"type":53,"value":1620},{"type":48,"tag":132,"props":1626,"children":1627},{},[1628,1633,1637],{"type":48,"tag":164,"props":1629,"children":1630},{},[1631],{"type":53,"value":1632},"Audit Logging (SQL)",{"type":48,"tag":164,"props":1634,"children":1635},{},[1636],{"type":53,"value":1454},{"type":48,"tag":164,"props":1638,"children":1639},{},[1640],{"type":53,"value":1454},{"type":48,"tag":132,"props":1642,"children":1643},{},[1644,1649,1654],{"type":48,"tag":164,"props":1645,"children":1646},{},[1647],{"type":53,"value":1648},"Managed Backups (ccloud)",{"type":48,"tag":164,"props":1650,"children":1651},{},[1652],{"type":53,"value":1653},"Yes (automatic)",{"type":48,"tag":164,"props":1655,"children":1656},{},[1657],{"type":53,"value":185},{"type":48,"tag":132,"props":1659,"children":1660},{},[1661,1666,1671],{"type":48,"tag":164,"props":1662,"children":1663},{},[1664],{"type":53,"value":1665},"Self-Managed Backups (SQL)",{"type":48,"tag":164,"props":1667,"children":1668},{},[1669],{"type":53,"value":1670},"Optional (if managed backups present)",{"type":48,"tag":164,"props":1672,"children":1673},{},[1674],{"type":53,"value":1675},"Yes — verify backup schedules exist and are running",{"type":48,"tag":56,"props":1677,"children":1678},{},[1679,1681,1687],{"type":53,"value":1680},"Skip N\u002FA checks for the detected deployment model and mark them as ",{"type":48,"tag":168,"props":1682,"children":1684},{"className":1683},[],[1685],{"type":53,"value":1686},"[N\u002FA]",{"type":53,"value":1688}," in the report rather than PASS\u002FFAIL.",{"type":48,"tag":634,"props":1690,"children":1692},{"id":1691},"step-2-assess-network-security",[1693],{"type":53,"value":1694},"Step 2: Assess Network Security",{"type":48,"tag":56,"props":1696,"children":1697},{},[1698,1702],{"type":48,"tag":65,"props":1699,"children":1700},{},[1701],{"type":53,"value":652},{"type":53,"value":1703}," Check all three layers based on cluster tier:",{"type":48,"tag":654,"props":1705,"children":1707},{"className":656,"code":1706,"language":658,"meta":659,"style":659},"# IP allowlists (all tiers)\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n\n# Ingress private endpoints (Standard+, Advanced) — via Cloud Console or API\n# Cloud Console: Networking > Private endpoint tab\n# API: GET \u002Fapi\u002Fv1\u002Fclusters\u002F{cluster_id}\u002Fnetworking\u002Fprivate-endpoint-connections\n\n# Egress private endpoints (Advanced only) — via Cloud Console or API\n# Cloud Console: Networking > Egress tab\n# API: GET \u002Fapi\u002Fv1\u002Fclusters\u002F{cluster_id}\u002Fnetworking\u002Fegress-endpoints\n",[1708],{"type":48,"tag":168,"props":1709,"children":1710},{"__ignoreMap":659},[1711,1719,1770,1777,1785,1793,1801,1808,1816,1825],{"type":48,"tag":665,"props":1712,"children":1713},{"class":667,"line":668},[1714],{"type":48,"tag":665,"props":1715,"children":1716},{"style":672},[1717],{"type":53,"value":1718},"# IP allowlists (all tiers)\n",{"type":48,"tag":665,"props":1720,"children":1721},{"class":667,"line":29},[1722,1726,1730,1735,1740,1744,1748,1753,1758,1762,1766],{"type":48,"tag":665,"props":1723,"children":1724},{"style":681},[1725],{"type":53,"value":173},{"type":48,"tag":665,"props":1727,"children":1728},{"style":686},[1729],{"type":53,"value":725},{"type":48,"tag":665,"props":1731,"children":1732},{"style":686},[1733],{"type":53,"value":1734}," networking",{"type":48,"tag":665,"props":1736,"children":1737},{"style":686},[1738],{"type":53,"value":1739}," allowlist",{"type":48,"tag":665,"props":1741,"children":1742},{"style":686},[1743],{"type":53,"value":730},{"type":48,"tag":665,"props":1745,"children":1746},{"style":784},[1747],{"type":53,"value":1135},{"type":48,"tag":665,"props":1749,"children":1750},{"style":686},[1751],{"type":53,"value":1752},"cluster-i",{"type":48,"tag":665,"props":1754,"children":1755},{"style":1143},[1756],{"type":53,"value":1757},"d",{"type":48,"tag":665,"props":1759,"children":1760},{"style":784},[1761],{"type":53,"value":1151},{"type":48,"tag":665,"props":1763,"children":1764},{"style":686},[1765],{"type":53,"value":735},{"type":48,"tag":665,"props":1767,"children":1768},{"style":686},[1769],{"type":53,"value":740},{"type":48,"tag":665,"props":1771,"children":1772},{"class":667,"line":25},[1773],{"type":48,"tag":665,"props":1774,"children":1775},{"emptyLinePlaceholder":700},[1776],{"type":53,"value":703},{"type":48,"tag":665,"props":1778,"children":1779},{"class":667,"line":706},[1780],{"type":48,"tag":665,"props":1781,"children":1782},{"style":672},[1783],{"type":53,"value":1784},"# Ingress private endpoints (Standard+, Advanced) — via Cloud Console or API\n",{"type":48,"tag":665,"props":1786,"children":1787},{"class":667,"line":715},[1788],{"type":48,"tag":665,"props":1789,"children":1790},{"style":672},[1791],{"type":53,"value":1792},"# Cloud Console: Networking > Private endpoint tab\n",{"type":48,"tag":665,"props":1794,"children":1795},{"class":667,"line":846},[1796],{"type":48,"tag":665,"props":1797,"children":1798},{"style":672},[1799],{"type":53,"value":1800},"# API: GET \u002Fapi\u002Fv1\u002Fclusters\u002F{cluster_id}\u002Fnetworking\u002Fprivate-endpoint-connections\n",{"type":48,"tag":665,"props":1802,"children":1803},{"class":667,"line":854},[1804],{"type":48,"tag":665,"props":1805,"children":1806},{"emptyLinePlaceholder":700},[1807],{"type":53,"value":703},{"type":48,"tag":665,"props":1809,"children":1810},{"class":667,"line":863},[1811],{"type":48,"tag":665,"props":1812,"children":1813},{"style":672},[1814],{"type":53,"value":1815},"# Egress private endpoints (Advanced only) — via Cloud Console or API\n",{"type":48,"tag":665,"props":1817,"children":1819},{"class":667,"line":1818},9,[1820],{"type":48,"tag":665,"props":1821,"children":1822},{"style":672},[1823],{"type":53,"value":1824},"# Cloud Console: Networking > Egress tab\n",{"type":48,"tag":665,"props":1826,"children":1828},{"class":667,"line":1827},10,[1829],{"type":48,"tag":665,"props":1830,"children":1831},{"style":672},[1832],{"type":53,"value":1833},"# API: GET \u002Fapi\u002Fv1\u002Fclusters\u002F{cluster_id}\u002Fnetworking\u002Fegress-endpoints\n",{"type":48,"tag":654,"props":1835,"children":1838},{"className":1836,"code":1837,"language":517,"meta":659,"style":659},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","-- HBA configuration (all tiers)\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n",[1839],{"type":48,"tag":168,"props":1840,"children":1841},{"__ignoreMap":659},[1842,1850],{"type":48,"tag":665,"props":1843,"children":1844},{"class":667,"line":668},[1845],{"type":48,"tag":665,"props":1846,"children":1847},{},[1848],{"type":53,"value":1849},"-- HBA configuration (all tiers)\n",{"type":48,"tag":665,"props":1851,"children":1852},{"class":667,"line":29},[1853],{"type":48,"tag":665,"props":1854,"children":1855},{},[1856],{"type":53,"value":1857},"SHOW CLUSTER SETTING server.host_based_authentication.configuration;\n",{"type":48,"tag":56,"props":1859,"children":1860},{},[1861],{"type":48,"tag":65,"props":1862,"children":1863},{},[1864],{"type":53,"value":1865},"Evaluate (Cloud):",{"type":48,"tag":80,"props":1867,"children":1868},{},[1869,1887,1912,1921,1931],{"type":48,"tag":84,"props":1870,"children":1871},{},[1872,1877,1879,1885],{"type":48,"tag":65,"props":1873,"children":1874},{},[1875],{"type":53,"value":1876},"FAIL",{"type":53,"value":1878}," if ",{"type":48,"tag":168,"props":1880,"children":1882},{"className":1881},[],[1883],{"type":53,"value":1884},"0.0.0.0\u002F0",{"type":53,"value":1886}," is in the IP allowlist (open to all traffic)",{"type":48,"tag":84,"props":1888,"children":1889},{},[1890,1895,1897,1903,1905,1911],{"type":48,"tag":65,"props":1891,"children":1892},{},[1893],{"type":53,"value":1894},"WARN",{"type":53,"value":1896}," if allowlist contains broad CIDR ranges (e.g., ",{"type":48,"tag":168,"props":1898,"children":1900},{"className":1899},[],[1901],{"type":53,"value":1902},"\u002F8",{"type":53,"value":1904}," or ",{"type":48,"tag":168,"props":1906,"children":1908},{"className":1907},[],[1909],{"type":53,"value":1910},"\u002F16",{"type":53,"value":251},{"type":48,"tag":84,"props":1913,"children":1914},{},[1915,1919],{"type":48,"tag":65,"props":1916,"children":1917},{},[1918],{"type":53,"value":1894},{"type":53,"value":1920}," if no private endpoints configured on Advanced plan",{"type":48,"tag":84,"props":1922,"children":1923},{},[1924,1929],{"type":48,"tag":65,"props":1925,"children":1926},{},[1927],{"type":53,"value":1928},"INFO",{"type":53,"value":1930}," if private endpoints not available on current tier",{"type":48,"tag":84,"props":1932,"children":1933},{},[1934,1939],{"type":48,"tag":65,"props":1935,"children":1936},{},[1937],{"type":53,"value":1938},"PASS",{"type":53,"value":1940}," if allowlist contains only specific, narrow CIDR ranges or private endpoints are configured",{"type":48,"tag":56,"props":1942,"children":1943},{},[1944,1948],{"type":48,"tag":65,"props":1945,"children":1946},{},[1947],{"type":53,"value":1167},{"type":53,"value":1949}," Check HBA configuration as the primary network-level auth control:",{"type":48,"tag":654,"props":1951,"children":1952},{"className":1836,"code":1857,"language":517,"meta":659,"style":659},[1953],{"type":48,"tag":168,"props":1954,"children":1955},{"__ignoreMap":659},[1956],{"type":48,"tag":665,"props":1957,"children":1958},{"class":667,"line":668},[1959],{"type":48,"tag":665,"props":1960,"children":1961},{},[1962],{"type":53,"value":1857},{"type":48,"tag":56,"props":1964,"children":1965},{},[1966],{"type":48,"tag":65,"props":1967,"children":1968},{},[1969],{"type":53,"value":1970},"Evaluate (self-hosted):",{"type":48,"tag":80,"props":1972,"children":1973},{},[1974,1983],{"type":48,"tag":84,"props":1975,"children":1976},{},[1977,1981],{"type":48,"tag":65,"props":1978,"children":1979},{},[1980],{"type":53,"value":1894},{"type":53,"value":1982}," if HBA configuration is empty or default — network security may be managed externally (firewalls, security groups, VPCs), so this is WARN not FAIL",{"type":48,"tag":84,"props":1984,"children":1985},{},[1986,1990],{"type":48,"tag":65,"props":1987,"children":1988},{},[1989],{"type":53,"value":1938},{"type":53,"value":1991}," if HBA rules restrict connections by IP, subnet, or auth method",{"type":48,"tag":634,"props":1993,"children":1995},{"id":1994},"step-3-check-sso-and-scim-configuration",[1996],{"type":53,"value":1997},"Step 3: Check SSO and SCIM Configuration",{"type":48,"tag":1999,"props":2000,"children":2001},"blockquote",{},[2002],{"type":48,"tag":56,"props":2003,"children":2004},{},[2005],{"type":53,"value":2006},"For self-hosted clusters, skip Cloud Console SSO and SCIM checks (N\u002FA). Database SSO checks still apply — check OIDC and\u002For LDAP\u002FAD configuration.",{"type":48,"tag":56,"props":2008,"children":2009},{},[2010,2014],{"type":48,"tag":65,"props":2011,"children":2012},{},[2013],{"type":53,"value":1467},{"type":53,"value":2015}," (Cloud Console UI > Organization Settings > Authentication — not via ccloud CLI):",{"type":48,"tag":80,"props":2017,"children":2018},{},[2019,2028],{"type":48,"tag":84,"props":2020,"children":2021},{},[2022,2026],{"type":48,"tag":65,"props":2023,"children":2024},{},[2025],{"type":53,"value":1876},{"type":53,"value":2027}," if SSO is not configured",{"type":48,"tag":84,"props":2029,"children":2030},{},[2031,2035],{"type":48,"tag":65,"props":2032,"children":2033},{},[2034],{"type":53,"value":1938},{"type":53,"value":2036}," if SAML or OIDC SSO is enabled and enforced",{"type":48,"tag":56,"props":2038,"children":2039},{},[2040],{"type":48,"tag":65,"props":2041,"children":2042},{},[2043],{"type":53,"value":2044},"Database SSO (Cluster SSO) — OIDC:",{"type":48,"tag":654,"props":2046,"children":2048},{"className":1836,"code":2047,"language":517,"meta":659,"style":659},"-- Check if Cluster SSO is enabled for SQL authentication\nSHOW CLUSTER SETTING server.oidc_authentication.enabled;\nSHOW CLUSTER SETTING server.oidc_authentication.provider_url;\n",[2049],{"type":48,"tag":168,"props":2050,"children":2051},{"__ignoreMap":659},[2052,2060,2068],{"type":48,"tag":665,"props":2053,"children":2054},{"class":667,"line":668},[2055],{"type":48,"tag":665,"props":2056,"children":2057},{},[2058],{"type":53,"value":2059},"-- Check if Cluster SSO is enabled for SQL authentication\n",{"type":48,"tag":665,"props":2061,"children":2062},{"class":667,"line":29},[2063],{"type":48,"tag":665,"props":2064,"children":2065},{},[2066],{"type":53,"value":2067},"SHOW CLUSTER SETTING server.oidc_authentication.enabled;\n",{"type":48,"tag":665,"props":2069,"children":2070},{"class":667,"line":25},[2071],{"type":48,"tag":665,"props":2072,"children":2073},{},[2074],{"type":53,"value":2075},"SHOW CLUSTER SETTING server.oidc_authentication.provider_url;\n",{"type":48,"tag":80,"props":2077,"children":2078},{},[2079,2101],{"type":48,"tag":84,"props":2080,"children":2081},{},[2082,2086,2087,2093,2095],{"type":48,"tag":65,"props":2083,"children":2084},{},[2085],{"type":53,"value":1876},{"type":53,"value":1878},{"type":48,"tag":168,"props":2088,"children":2090},{"className":2089},[],[2091],{"type":53,"value":2092},"server.oidc_authentication.enabled",{"type":53,"value":2094}," is ",{"type":48,"tag":168,"props":2096,"children":2098},{"className":2097},[],[2099],{"type":53,"value":2100},"false",{"type":48,"tag":84,"props":2102,"children":2103},{},[2104,2108],{"type":48,"tag":65,"props":2105,"children":2106},{},[2107],{"type":53,"value":1938},{"type":53,"value":2109}," if enabled with a valid provider URL",{"type":48,"tag":56,"props":2111,"children":2112},{},[2113],{"type":48,"tag":65,"props":2114,"children":2115},{},[2116],{"type":53,"value":2117},"Database SSO — LDAP\u002FAD (Cloud and self-hosted):",{"type":48,"tag":654,"props":2119,"children":2121},{"className":1836,"code":2120,"language":517,"meta":659,"style":659},"-- Check if LDAP authentication is configured via HBA\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n-- Look for ldap auth method entries in the HBA configuration\n",[2122],{"type":48,"tag":168,"props":2123,"children":2124},{"__ignoreMap":659},[2125,2133,2140],{"type":48,"tag":665,"props":2126,"children":2127},{"class":667,"line":668},[2128],{"type":48,"tag":665,"props":2129,"children":2130},{},[2131],{"type":53,"value":2132},"-- Check if LDAP authentication is configured via HBA\n",{"type":48,"tag":665,"props":2134,"children":2135},{"class":667,"line":29},[2136],{"type":48,"tag":665,"props":2137,"children":2138},{},[2139],{"type":53,"value":1857},{"type":48,"tag":665,"props":2141,"children":2142},{"class":667,"line":25},[2143],{"type":48,"tag":665,"props":2144,"children":2145},{},[2146],{"type":53,"value":2147},"-- Look for ldap auth method entries in the HBA configuration\n",{"type":48,"tag":80,"props":2149,"children":2150},{},[2151,2168],{"type":48,"tag":84,"props":2152,"children":2153},{},[2154,2158,2160,2166],{"type":48,"tag":65,"props":2155,"children":2156},{},[2157],{"type":53,"value":1938},{"type":53,"value":2159}," if HBA contains entries with ",{"type":48,"tag":168,"props":2161,"children":2163},{"className":2162},[],[2164],{"type":53,"value":2165},"ldap",{"type":53,"value":2167}," auth method",{"type":48,"tag":84,"props":2169,"children":2170},{},[2171,2175],{"type":48,"tag":65,"props":2172,"children":2173},{},[2174],{"type":53,"value":1928},{"type":53,"value":2176}," if LDAP is not configured (OIDC may be used instead)",{"type":48,"tag":56,"props":2178,"children":2179},{},[2180,2184],{"type":48,"tag":65,"props":2181,"children":2182},{},[2183],{"type":53,"value":1483},{"type":53,"value":2185}," (Cloud Console UI > Organization Settings > Authentication > SCIM):",{"type":48,"tag":80,"props":2187,"children":2188},{},[2189],{"type":48,"tag":84,"props":2190,"children":2191},{},[2192,2196,2198,2202],{"type":48,"tag":65,"props":2193,"children":2194},{},[2195],{"type":53,"value":1876},{"type":53,"value":2197}," if SCIM endpoint is not enabled; ",{"type":48,"tag":65,"props":2199,"children":2200},{},[2201],{"type":53,"value":1938},{"type":53,"value":2203}," if enabled and connected to an IdP",{"type":48,"tag":56,"props":2205,"children":2206},{},[2207],{"type":48,"tag":65,"props":2208,"children":2209},{},[2210],{"type":53,"value":2211},"Auto user provisioning on Database:",{"type":48,"tag":654,"props":2213,"children":2215},{"className":1836,"code":2214,"language":517,"meta":659,"style":659},"-- Check if SQL users are automatically provisioned from SSO identities\nSHOW CLUSTER SETTING server.identity_map.configuration;\n",[2216],{"type":48,"tag":168,"props":2217,"children":2218},{"__ignoreMap":659},[2219,2227],{"type":48,"tag":665,"props":2220,"children":2221},{"class":667,"line":668},[2222],{"type":48,"tag":665,"props":2223,"children":2224},{},[2225],{"type":53,"value":2226},"-- Check if SQL users are automatically provisioned from SSO identities\n",{"type":48,"tag":665,"props":2228,"children":2229},{"class":667,"line":29},[2230],{"type":48,"tag":665,"props":2231,"children":2232},{},[2233],{"type":53,"value":2234},"SHOW CLUSTER SETTING server.identity_map.configuration;\n",{"type":48,"tag":80,"props":2236,"children":2237},{},[2238,2247],{"type":48,"tag":84,"props":2239,"children":2240},{},[2241,2245],{"type":48,"tag":65,"props":2242,"children":2243},{},[2244],{"type":53,"value":1876},{"type":53,"value":2246}," if identity mapping is not configured",{"type":48,"tag":84,"props":2248,"children":2249},{},[2250,2254],{"type":48,"tag":65,"props":2251,"children":2252},{},[2253],{"type":53,"value":1938},{"type":53,"value":2255}," if identity mapping routes IdP identities to SQL users",{"type":48,"tag":634,"props":2257,"children":2259},{"id":2258},"step-4-audit-users-and-roles",[2260],{"type":53,"value":2261},"Step 4: Audit Users and Roles",{"type":48,"tag":654,"props":2263,"children":2265},{"className":1836,"code":2264,"language":517,"meta":659,"style":659},"-- List all users and their roles\nSELECT\n  username,\n  options,\n  member_of\nFROM [SHOW USERS]\nORDER BY username;\n",[2266],{"type":48,"tag":168,"props":2267,"children":2268},{"__ignoreMap":659},[2269,2277,2285,2293,2301,2309,2317],{"type":48,"tag":665,"props":2270,"children":2271},{"class":667,"line":668},[2272],{"type":48,"tag":665,"props":2273,"children":2274},{},[2275],{"type":53,"value":2276},"-- List all users and their roles\n",{"type":48,"tag":665,"props":2278,"children":2279},{"class":667,"line":29},[2280],{"type":48,"tag":665,"props":2281,"children":2282},{},[2283],{"type":53,"value":2284},"SELECT\n",{"type":48,"tag":665,"props":2286,"children":2287},{"class":667,"line":25},[2288],{"type":48,"tag":665,"props":2289,"children":2290},{},[2291],{"type":53,"value":2292},"  username,\n",{"type":48,"tag":665,"props":2294,"children":2295},{"class":667,"line":706},[2296],{"type":48,"tag":665,"props":2297,"children":2298},{},[2299],{"type":53,"value":2300},"  options,\n",{"type":48,"tag":665,"props":2302,"children":2303},{"class":667,"line":715},[2304],{"type":48,"tag":665,"props":2305,"children":2306},{},[2307],{"type":53,"value":2308},"  member_of\n",{"type":48,"tag":665,"props":2310,"children":2311},{"class":667,"line":846},[2312],{"type":48,"tag":665,"props":2313,"children":2314},{},[2315],{"type":53,"value":2316},"FROM [SHOW USERS]\n",{"type":48,"tag":665,"props":2318,"children":2319},{"class":667,"line":854},[2320],{"type":48,"tag":665,"props":2321,"children":2322},{},[2323],{"type":53,"value":2324},"ORDER BY username;\n",{"type":48,"tag":56,"props":2326,"children":2327},{},[2328,2329,2335],{"type":53,"value":428},{"type":48,"tag":430,"props":2330,"children":2332},{"href":2331},"references\u002Fsql-queries.md",[2333],{"type":53,"value":2334},"SQL queries reference",{"type":53,"value":2336}," for additional role audit queries.",{"type":48,"tag":634,"props":2338,"children":2340},{"id":2339},"step-5-check-privileges",[2341],{"type":53,"value":2342},"Step 5: Check Privileges",{"type":48,"tag":654,"props":2344,"children":2346},{"className":1836,"code":2345,"language":517,"meta":659,"style":659},"-- Count admin role members\nSELECT COUNT(*) AS admin_count\nFROM [SHOW GRANTS ON ROLE admin];\n\n-- Check PUBLIC role privileges on the current database\n-- Note: SHOW GRANTS FOR public is scoped to the current database.\n-- Run this query from each application database to get full coverage.\nSELECT\n  database_name,\n  schema_name,\n  object_name,\n  object_type,\n  privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public'\nORDER BY database_name, object_name;\n",[2347],{"type":48,"tag":168,"props":2348,"children":2349},{"__ignoreMap":659},[2350,2358,2366,2374,2381,2389,2397,2405,2412,2420,2428,2437,2446,2455,2464,2473,2482],{"type":48,"tag":665,"props":2351,"children":2352},{"class":667,"line":668},[2353],{"type":48,"tag":665,"props":2354,"children":2355},{},[2356],{"type":53,"value":2357},"-- Count admin role members\n",{"type":48,"tag":665,"props":2359,"children":2360},{"class":667,"line":29},[2361],{"type":48,"tag":665,"props":2362,"children":2363},{},[2364],{"type":53,"value":2365},"SELECT COUNT(*) AS admin_count\n",{"type":48,"tag":665,"props":2367,"children":2368},{"class":667,"line":25},[2369],{"type":48,"tag":665,"props":2370,"children":2371},{},[2372],{"type":53,"value":2373},"FROM [SHOW GRANTS ON ROLE admin];\n",{"type":48,"tag":665,"props":2375,"children":2376},{"class":667,"line":706},[2377],{"type":48,"tag":665,"props":2378,"children":2379},{"emptyLinePlaceholder":700},[2380],{"type":53,"value":703},{"type":48,"tag":665,"props":2382,"children":2383},{"class":667,"line":715},[2384],{"type":48,"tag":665,"props":2385,"children":2386},{},[2387],{"type":53,"value":2388},"-- Check PUBLIC role privileges on the current database\n",{"type":48,"tag":665,"props":2390,"children":2391},{"class":667,"line":846},[2392],{"type":48,"tag":665,"props":2393,"children":2394},{},[2395],{"type":53,"value":2396},"-- Note: SHOW GRANTS FOR public is scoped to the current database.\n",{"type":48,"tag":665,"props":2398,"children":2399},{"class":667,"line":854},[2400],{"type":48,"tag":665,"props":2401,"children":2402},{},[2403],{"type":53,"value":2404},"-- Run this query from each application database to get full coverage.\n",{"type":48,"tag":665,"props":2406,"children":2407},{"class":667,"line":863},[2408],{"type":48,"tag":665,"props":2409,"children":2410},{},[2411],{"type":53,"value":2284},{"type":48,"tag":665,"props":2413,"children":2414},{"class":667,"line":1818},[2415],{"type":48,"tag":665,"props":2416,"children":2417},{},[2418],{"type":53,"value":2419},"  database_name,\n",{"type":48,"tag":665,"props":2421,"children":2422},{"class":667,"line":1827},[2423],{"type":48,"tag":665,"props":2424,"children":2425},{},[2426],{"type":53,"value":2427},"  schema_name,\n",{"type":48,"tag":665,"props":2429,"children":2431},{"class":667,"line":2430},11,[2432],{"type":48,"tag":665,"props":2433,"children":2434},{},[2435],{"type":53,"value":2436},"  object_name,\n",{"type":48,"tag":665,"props":2438,"children":2440},{"class":667,"line":2439},12,[2441],{"type":48,"tag":665,"props":2442,"children":2443},{},[2444],{"type":53,"value":2445},"  object_type,\n",{"type":48,"tag":665,"props":2447,"children":2449},{"class":667,"line":2448},13,[2450],{"type":48,"tag":665,"props":2451,"children":2452},{},[2453],{"type":53,"value":2454},"  privilege_type\n",{"type":48,"tag":665,"props":2456,"children":2458},{"class":667,"line":2457},14,[2459],{"type":48,"tag":665,"props":2460,"children":2461},{},[2462],{"type":53,"value":2463},"FROM [SHOW GRANTS FOR public]\n",{"type":48,"tag":665,"props":2465,"children":2467},{"class":667,"line":2466},15,[2468],{"type":48,"tag":665,"props":2469,"children":2470},{},[2471],{"type":53,"value":2472},"WHERE privilege_type NOT IN ('USAGE')\n",{"type":48,"tag":665,"props":2474,"children":2476},{"class":667,"line":2475},16,[2477],{"type":48,"tag":665,"props":2478,"children":2479},{},[2480],{"type":53,"value":2481},"  AND schema_name = 'public'\n",{"type":48,"tag":665,"props":2483,"children":2485},{"class":667,"line":2484},17,[2486],{"type":48,"tag":665,"props":2487,"children":2488},{},[2489],{"type":53,"value":2490},"ORDER BY database_name, object_name;\n",{"type":48,"tag":56,"props":2492,"children":2493},{},[2494,2499,2501,2507,2509,2515],{"type":48,"tag":65,"props":2495,"children":2496},{},[2497],{"type":53,"value":2498},"Important:",{"type":53,"value":2500}," ",{"type":48,"tag":168,"props":2502,"children":2504},{"className":2503},[],[2505],{"type":53,"value":2506},"SHOW GRANTS FOR public",{"type":53,"value":2508}," is scoped to the current database. Run ",{"type":48,"tag":168,"props":2510,"children":2512},{"className":2511},[],[2513],{"type":53,"value":2514},"SHOW DATABASES;",{"type":53,"value":2516}," and repeat the query from each database for full coverage.",{"type":48,"tag":56,"props":2518,"children":2519},{},[2520],{"type":48,"tag":65,"props":2521,"children":2522},{},[2523],{"type":53,"value":2524},"Evaluate:",{"type":48,"tag":80,"props":2526,"children":2527},{},[2528,2537,2546,2555],{"type":48,"tag":84,"props":2529,"children":2530},{},[2531,2535],{"type":48,"tag":65,"props":2532,"children":2533},{},[2534],{"type":53,"value":1876},{"type":53,"value":2536}," if more than 5 users have admin role",{"type":48,"tag":84,"props":2538,"children":2539},{},[2540,2544],{"type":48,"tag":65,"props":2541,"children":2542},{},[2543],{"type":53,"value":1876},{"type":53,"value":2545}," if PUBLIC has SELECT, INSERT, UPDATE, or DELETE on application tables",{"type":48,"tag":84,"props":2547,"children":2548},{},[2549,2553],{"type":48,"tag":65,"props":2550,"children":2551},{},[2552],{"type":53,"value":1894},{"type":53,"value":2554}," if admin count is between 3 and 5",{"type":48,"tag":84,"props":2556,"children":2557},{},[2558,2562],{"type":48,"tag":65,"props":2559,"children":2560},{},[2561],{"type":53,"value":1938},{"type":53,"value":2563}," if admin count is 1-2 and PUBLIC has minimal grants",{"type":48,"tag":634,"props":2565,"children":2567},{"id":2566},"step-6-verify-encryption",[2568],{"type":53,"value":2569},"Step 6: Verify Encryption",{"type":48,"tag":56,"props":2571,"children":2572},{},[2573],{"type":48,"tag":65,"props":2574,"children":2575},{},[2576],{"type":53,"value":2577},"CMEK status (Cloud clusters):",{"type":48,"tag":654,"props":2579,"children":2581},{"className":656,"code":2580,"language":658,"meta":659,"style":659},"# Check CMEK configuration (Advanced plan with Advanced Security Add-on)\nccloud cluster info \u003Ccluster-name> -o json\n# Look for cmek_config in the output\n",[2582],{"type":48,"tag":168,"props":2583,"children":2584},{"__ignoreMap":659},[2585,2593,2632],{"type":48,"tag":665,"props":2586,"children":2587},{"class":667,"line":668},[2588],{"type":48,"tag":665,"props":2589,"children":2590},{"style":672},[2591],{"type":53,"value":2592},"# Check CMEK configuration (Advanced plan with Advanced Security Add-on)\n",{"type":48,"tag":665,"props":2594,"children":2595},{"class":667,"line":29},[2596,2600,2604,2608,2612,2616,2620,2624,2628],{"type":48,"tag":665,"props":2597,"children":2598},{"style":681},[2599],{"type":53,"value":173},{"type":48,"tag":665,"props":2601,"children":2602},{"style":686},[2603],{"type":53,"value":725},{"type":48,"tag":665,"props":2605,"children":2606},{"style":686},[2607],{"type":53,"value":1130},{"type":48,"tag":665,"props":2609,"children":2610},{"style":784},[2611],{"type":53,"value":1135},{"type":48,"tag":665,"props":2613,"children":2614},{"style":686},[2615],{"type":53,"value":1140},{"type":48,"tag":665,"props":2617,"children":2618},{"style":1143},[2619],{"type":53,"value":1146},{"type":48,"tag":665,"props":2621,"children":2622},{"style":784},[2623],{"type":53,"value":1151},{"type":48,"tag":665,"props":2625,"children":2626},{"style":686},[2627],{"type":53,"value":735},{"type":48,"tag":665,"props":2629,"children":2630},{"style":686},[2631],{"type":53,"value":740},{"type":48,"tag":665,"props":2633,"children":2634},{"class":667,"line":25},[2635],{"type":48,"tag":665,"props":2636,"children":2637},{"style":672},[2638],{"type":53,"value":2639},"# Look for cmek_config in the output\n",{"type":48,"tag":56,"props":2641,"children":2642},{},[2643],{"type":48,"tag":65,"props":2644,"children":2645},{},[2646],{"type":53,"value":2647},"Evaluate by plan type (Cloud):",{"type":48,"tag":80,"props":2649,"children":2650},{},[2651,2661,2671,2681],{"type":48,"tag":84,"props":2652,"children":2653},{},[2654,2659],{"type":48,"tag":65,"props":2655,"children":2656},{},[2657],{"type":53,"value":2658},"Standard plan:",{"type":53,"value":2660}," INFO — \"Upgrade to Advanced plan with Advanced Security Add-on to enable CMEK\"",{"type":48,"tag":84,"props":2662,"children":2663},{},[2664,2669],{"type":48,"tag":65,"props":2665,"children":2666},{},[2667],{"type":53,"value":2668},"Advanced plan without Advanced Security Add-on:",{"type":53,"value":2670}," INFO — \"Add Advanced Security Add-on to enable CMEK\"",{"type":48,"tag":84,"props":2672,"children":2673},{},[2674,2679],{"type":48,"tag":65,"props":2675,"children":2676},{},[2677],{"type":53,"value":2678},"Advanced plan with Advanced Security Add-on, CMEK not enabled:",{"type":53,"value":2680}," FAIL — CMEK not enabled despite plan supporting it",{"type":48,"tag":84,"props":2682,"children":2683},{},[2684,2689],{"type":48,"tag":65,"props":2685,"children":2686},{},[2687],{"type":53,"value":2688},"Advanced plan with Advanced Security Add-on, CMEK enabled:",{"type":53,"value":2690}," PASS",{"type":48,"tag":56,"props":2692,"children":2693},{},[2694],{"type":48,"tag":65,"props":2695,"children":2696},{},[2697],{"type":53,"value":2698},"Enterprise Encryption (self-hosted — skip CMEK, check this instead):",{"type":48,"tag":56,"props":2700,"children":2701},{},[2702,2704,2710],{"type":53,"value":2703},"Enterprise Encryption-at-Rest is configured at node start via the\n",{"type":48,"tag":168,"props":2705,"children":2707},{"className":2706},[],[2708],{"type":53,"value":2709},"--enterprise-encryption",{"type":53,"value":2711}," flag and is not exposed as a SQL cluster setting.\nConfirm it by:",{"type":48,"tag":80,"props":2713,"children":2714},{},[2715,2726,2737,2756,2765,2774],{"type":48,"tag":84,"props":2716,"children":2717},{},[2718,2720],{"type":53,"value":2719},"Inspecting the node's startup arguments (process command line \u002F systemd unit\n\u002F Kubernetes pod spec) for ",{"type":48,"tag":168,"props":2721,"children":2723},{"className":2722},[],[2724],{"type":53,"value":2725},"--enterprise-encryption=...",{"type":48,"tag":84,"props":2727,"children":2728},{},[2729,2731],{"type":53,"value":2730},"Checking the per-node Prometheus endpoint:\n",{"type":48,"tag":168,"props":2732,"children":2734},{"className":2733},[],[2735],{"type":53,"value":2736},"curl -ks https:\u002F\u002F\u003Cnode>:8080\u002F_status\u002Fvars | grep '^rocksdb_encryption_'",{"type":48,"tag":84,"props":2738,"children":2739},{},[2740,2742,2747,2749,2754],{"type":53,"value":2741},"The DB Console ",{"type":48,"tag":65,"props":2743,"children":2744},{},[2745],{"type":53,"value":2746},"Advanced Debug",{"type":53,"value":2748}," → ",{"type":48,"tag":65,"props":2750,"children":2751},{},[2752],{"type":53,"value":2753},"Stores",{"type":53,"value":2755}," view reports the active\nencryption type per store",{"type":48,"tag":84,"props":2757,"children":2758},{},[2759,2763],{"type":48,"tag":65,"props":2760,"children":2761},{},[2762],{"type":53,"value":1876},{"type":53,"value":2764}," if not enabled and cluster stores sensitive data",{"type":48,"tag":84,"props":2766,"children":2767},{},[2768,2772],{"type":48,"tag":65,"props":2769,"children":2770},{},[2771],{"type":53,"value":1894},{"type":53,"value":2773}," if encryption status cannot be determined",{"type":48,"tag":84,"props":2775,"children":2776},{},[2777,2781],{"type":48,"tag":65,"props":2778,"children":2779},{},[2780],{"type":53,"value":1938},{"type":53,"value":2782}," if enabled with AES-256",{"type":48,"tag":56,"props":2784,"children":2785},{},[2786,2791],{"type":48,"tag":65,"props":2787,"children":2788},{},[2789],{"type":53,"value":2790},"TLS (Cloud):",{"type":53,"value":2792}," Always PASS — enforced on all connections.",{"type":48,"tag":56,"props":2794,"children":2795},{},[2796,2801],{"type":48,"tag":65,"props":2797,"children":2798},{},[2799],{"type":53,"value":2800},"TLS (self-hosted):",{"type":53,"value":2802}," Verify certificate validity and expiry (NOT auto-PASS):",{"type":48,"tag":654,"props":2804,"children":2806},{"className":656,"code":2805,"language":658,"meta":659,"style":659},"cockroach cert list --certs-dir=\u003Ccerts-dir>\nopenssl x509 -in \u003Ccerts-dir>\u002Fnode.crt -noout -enddate\n",[2807],{"type":48,"tag":168,"props":2808,"children":2809},{"__ignoreMap":659},[2810,2842],{"type":48,"tag":665,"props":2811,"children":2812},{"class":667,"line":668},[2813,2817,2822,2826,2830,2834,2838],{"type":48,"tag":665,"props":2814,"children":2815},{"style":681},[2816],{"type":53,"value":771},{"type":48,"tag":665,"props":2818,"children":2819},{"style":686},[2820],{"type":53,"value":2821}," cert",{"type":48,"tag":665,"props":2823,"children":2824},{"style":686},[2825],{"type":53,"value":730},{"type":48,"tag":665,"props":2827,"children":2828},{"style":686},[2829],{"type":53,"value":1204},{"type":48,"tag":665,"props":2831,"children":2832},{"style":784},[2833],{"type":53,"value":1209},{"type":48,"tag":665,"props":2835,"children":2836},{"style":686},[2837],{"type":53,"value":1214},{"type":48,"tag":665,"props":2839,"children":2840},{"style":784},[2841],{"type":53,"value":1237},{"type":48,"tag":665,"props":2843,"children":2844},{"class":667,"line":29},[2845,2849,2854,2859,2863,2868,2873,2877,2882,2887],{"type":48,"tag":665,"props":2846,"children":2847},{"style":681},[2848],{"type":53,"value":227},{"type":48,"tag":665,"props":2850,"children":2851},{"style":686},[2852],{"type":53,"value":2853}," x509",{"type":48,"tag":665,"props":2855,"children":2856},{"style":686},[2857],{"type":53,"value":2858}," -in",{"type":48,"tag":665,"props":2860,"children":2861},{"style":784},[2862],{"type":53,"value":1135},{"type":48,"tag":665,"props":2864,"children":2865},{"style":686},[2866],{"type":53,"value":2867},"certs-di",{"type":48,"tag":665,"props":2869,"children":2870},{"style":1143},[2871],{"type":53,"value":2872},"r",{"type":48,"tag":665,"props":2874,"children":2875},{"style":784},[2876],{"type":53,"value":1151},{"type":48,"tag":665,"props":2878,"children":2879},{"style":686},[2880],{"type":53,"value":2881},"\u002Fnode.crt",{"type":48,"tag":665,"props":2883,"children":2884},{"style":686},[2885],{"type":53,"value":2886}," -noout",{"type":48,"tag":665,"props":2888,"children":2889},{"style":686},[2890],{"type":53,"value":2891}," -enddate\n",{"type":48,"tag":80,"props":2893,"children":2894},{},[2895,2904,2913],{"type":48,"tag":84,"props":2896,"children":2897},{},[2898,2902],{"type":48,"tag":65,"props":2899,"children":2900},{},[2901],{"type":53,"value":1876},{"type":53,"value":2903}," if any certificate expires within 30 days",{"type":48,"tag":84,"props":2905,"children":2906},{},[2907,2911],{"type":48,"tag":65,"props":2908,"children":2909},{},[2910],{"type":53,"value":1894},{"type":53,"value":2912}," if any certificate expires within 90 days",{"type":48,"tag":84,"props":2914,"children":2915},{},[2916,2920],{"type":48,"tag":65,"props":2917,"children":2918},{},[2919],{"type":53,"value":1938},{"type":53,"value":2921}," if all certificates valid with 90+ days remaining",{"type":48,"tag":56,"props":2923,"children":2924},{},[2925,2930,2931],{"type":48,"tag":65,"props":2926,"children":2927},{},[2928],{"type":53,"value":2929},"Remediation (self-hosted):",{"type":53,"value":2500},{"type":48,"tag":430,"props":2932,"children":2934},{"href":2933},"..\u002Fmanaging-tls-certificates\u002FSKILL.md",[2935],{"type":53,"value":2936},"managing-tls-certificates",{"type":48,"tag":56,"props":2938,"children":2939},{},[2940],{"type":48,"tag":65,"props":2941,"children":2942},{},[2943],{"type":53,"value":2944},"Cryptographic posture (both Cloud and self-hosted — informational only):",{"type":48,"tag":654,"props":2946,"children":2948},{"className":656,"code":2947,"language":658,"meta":659,"style":659},"# Primary: sslyze with STARTTLS postgres (if available)\nsslyze \u003Chost>:26257 --starttls postgres\n\n# Supplementary: openssl with STARTTLS postgres\nopenssl s_client -connect \u003Chost>:26257 -starttls postgres -showcerts -tlsextdebug 2>&1\n\n# PQC probe: offer ML-KEM hybrid, check if server accepts\nopenssl s_client -connect \u003Chost>:26257 -starttls postgres -groups X25519MLKEM768:x25519 2>&1\n",[2949],{"type":48,"tag":168,"props":2950,"children":2951},{"__ignoreMap":659},[2952,2960,3000,3007,3015,3077,3084,3092],{"type":48,"tag":665,"props":2953,"children":2954},{"class":667,"line":668},[2955],{"type":48,"tag":665,"props":2956,"children":2957},{"style":672},[2958],{"type":53,"value":2959},"# Primary: sslyze with STARTTLS postgres (if available)\n",{"type":48,"tag":665,"props":2961,"children":2962},{"class":667,"line":29},[2963,2967,2971,2976,2981,2985,2990,2995],{"type":48,"tag":665,"props":2964,"children":2965},{"style":681},[2966],{"type":53,"value":263},{"type":48,"tag":665,"props":2968,"children":2969},{"style":784},[2970],{"type":53,"value":1135},{"type":48,"tag":665,"props":2972,"children":2973},{"style":686},[2974],{"type":53,"value":2975},"hos",{"type":48,"tag":665,"props":2977,"children":2978},{"style":1143},[2979],{"type":53,"value":2980},"t",{"type":48,"tag":665,"props":2982,"children":2983},{"style":784},[2984],{"type":53,"value":1151},{"type":48,"tag":665,"props":2986,"children":2987},{"style":686},[2988],{"type":53,"value":2989},":26257",{"type":48,"tag":665,"props":2991,"children":2992},{"style":686},[2993],{"type":53,"value":2994}," --starttls",{"type":48,"tag":665,"props":2996,"children":2997},{"style":686},[2998],{"type":53,"value":2999}," postgres\n",{"type":48,"tag":665,"props":3001,"children":3002},{"class":667,"line":25},[3003],{"type":48,"tag":665,"props":3004,"children":3005},{"emptyLinePlaceholder":700},[3006],{"type":53,"value":703},{"type":48,"tag":665,"props":3008,"children":3009},{"class":667,"line":706},[3010],{"type":48,"tag":665,"props":3011,"children":3012},{"style":672},[3013],{"type":53,"value":3014},"# Supplementary: openssl with STARTTLS postgres\n",{"type":48,"tag":665,"props":3016,"children":3017},{"class":667,"line":715},[3018,3022,3027,3032,3036,3040,3044,3048,3052,3057,3062,3067,3072],{"type":48,"tag":665,"props":3019,"children":3020},{"style":681},[3021],{"type":53,"value":227},{"type":48,"tag":665,"props":3023,"children":3024},{"style":686},[3025],{"type":53,"value":3026}," s_client",{"type":48,"tag":665,"props":3028,"children":3029},{"style":686},[3030],{"type":53,"value":3031}," -connect",{"type":48,"tag":665,"props":3033,"children":3034},{"style":784},[3035],{"type":53,"value":1135},{"type":48,"tag":665,"props":3037,"children":3038},{"style":686},[3039],{"type":53,"value":2975},{"type":48,"tag":665,"props":3041,"children":3042},{"style":1143},[3043],{"type":53,"value":2980},{"type":48,"tag":665,"props":3045,"children":3046},{"style":784},[3047],{"type":53,"value":1151},{"type":48,"tag":665,"props":3049,"children":3050},{"style":686},[3051],{"type":53,"value":2989},{"type":48,"tag":665,"props":3053,"children":3054},{"style":686},[3055],{"type":53,"value":3056}," -starttls",{"type":48,"tag":665,"props":3058,"children":3059},{"style":686},[3060],{"type":53,"value":3061}," postgres",{"type":48,"tag":665,"props":3063,"children":3064},{"style":686},[3065],{"type":53,"value":3066}," -showcerts",{"type":48,"tag":665,"props":3068,"children":3069},{"style":686},[3070],{"type":53,"value":3071}," -tlsextdebug",{"type":48,"tag":665,"props":3073,"children":3074},{"style":784},[3075],{"type":53,"value":3076}," 2>&1\n",{"type":48,"tag":665,"props":3078,"children":3079},{"class":667,"line":846},[3080],{"type":48,"tag":665,"props":3081,"children":3082},{"emptyLinePlaceholder":700},[3083],{"type":53,"value":703},{"type":48,"tag":665,"props":3085,"children":3086},{"class":667,"line":854},[3087],{"type":48,"tag":665,"props":3088,"children":3089},{"style":672},[3090],{"type":53,"value":3091},"# PQC probe: offer ML-KEM hybrid, check if server accepts\n",{"type":48,"tag":665,"props":3093,"children":3094},{"class":667,"line":863},[3095,3099,3103,3107,3111,3115,3119,3123,3127,3131,3135,3140,3145],{"type":48,"tag":665,"props":3096,"children":3097},{"style":681},[3098],{"type":53,"value":227},{"type":48,"tag":665,"props":3100,"children":3101},{"style":686},[3102],{"type":53,"value":3026},{"type":48,"tag":665,"props":3104,"children":3105},{"style":686},[3106],{"type":53,"value":3031},{"type":48,"tag":665,"props":3108,"children":3109},{"style":784},[3110],{"type":53,"value":1135},{"type":48,"tag":665,"props":3112,"children":3113},{"style":686},[3114],{"type":53,"value":2975},{"type":48,"tag":665,"props":3116,"children":3117},{"style":1143},[3118],{"type":53,"value":2980},{"type":48,"tag":665,"props":3120,"children":3121},{"style":784},[3122],{"type":53,"value":1151},{"type":48,"tag":665,"props":3124,"children":3125},{"style":686},[3126],{"type":53,"value":2989},{"type":48,"tag":665,"props":3128,"children":3129},{"style":686},[3130],{"type":53,"value":3056},{"type":48,"tag":665,"props":3132,"children":3133},{"style":686},[3134],{"type":53,"value":3061},{"type":48,"tag":665,"props":3136,"children":3137},{"style":686},[3138],{"type":53,"value":3139}," -groups",{"type":48,"tag":665,"props":3141,"children":3142},{"style":686},[3143],{"type":53,"value":3144}," X25519MLKEM768:x25519",{"type":48,"tag":665,"props":3146,"children":3147},{"style":784},[3148],{"type":53,"value":3076},{"type":48,"tag":80,"props":3150,"children":3151},{},[3152,3161,3170],{"type":48,"tag":84,"props":3153,"children":3154},{},[3155,3159],{"type":48,"tag":65,"props":3156,"children":3157},{},[3158],{"type":53,"value":1928},{"type":53,"value":3160}," — TLS version (should be TLS 1.3; note if TLS 1.2 only)",{"type":48,"tag":84,"props":3162,"children":3163},{},[3164,3168],{"type":48,"tag":65,"props":3165,"children":3166},{},[3167],{"type":53,"value":1928},{"type":53,"value":3169}," — PQC hybrid cipher support (e.g., X25519MLKEM768) — emerging, not yet a FAIL condition",{"type":48,"tag":84,"props":3171,"children":3172},{},[3173,3177],{"type":48,"tag":65,"props":3174,"children":3175},{},[3176],{"type":53,"value":1928},{"type":53,"value":3178}," — Encryption key size (check for AES-256; note if AES-128)",{"type":48,"tag":1999,"props":3180,"children":3181},{},[3182],{"type":48,"tag":56,"props":3183,"children":3184},{},[3185,3190,3192,3198,3200,3205,3207,3212,3214,3219],{"type":48,"tag":65,"props":3186,"children":3187},{},[3188],{"type":53,"value":3189},"Note:",{"type":53,"value":3191}," CockroachDB uses PostgreSQL wire protocol, so ",{"type":48,"tag":168,"props":3193,"children":3195},{"className":3194},[],[3196],{"type":53,"value":3197},"openssl s_client",{"type":53,"value":3199}," requires ",{"type":48,"tag":168,"props":3201,"children":3203},{"className":3202},[],[3204],{"type":53,"value":249},{"type":53,"value":3206}," to negotiate TLS correctly. Without this flag, the connection will fail. ",{"type":48,"tag":168,"props":3208,"children":3210},{"className":3209},[],[3211],{"type":53,"value":263},{"type":53,"value":3213}," similarly requires ",{"type":48,"tag":168,"props":3215,"children":3217},{"className":3216},[],[3218],{"type":53,"value":283},{"type":53,"value":3220},".",{"type":48,"tag":634,"props":3222,"children":3224},{"id":3223},"step-7-check-audit-logging",[3225],{"type":53,"value":3226},"Step 7: Check Audit Logging",{"type":48,"tag":654,"props":3228,"children":3230},{"className":1836,"code":3229,"language":517,"meta":659,"style":659},"-- Check audit log configuration\nSHOW CLUSTER SETTING sql.log.user_audit;\n\n-- Check admin audit logging\nSHOW CLUSTER SETTING sql.log.admin_audit.enabled;\n",[3231],{"type":48,"tag":168,"props":3232,"children":3233},{"__ignoreMap":659},[3234,3242,3250,3257,3265],{"type":48,"tag":665,"props":3235,"children":3236},{"class":667,"line":668},[3237],{"type":48,"tag":665,"props":3238,"children":3239},{},[3240],{"type":53,"value":3241},"-- Check audit log configuration\n",{"type":48,"tag":665,"props":3243,"children":3244},{"class":667,"line":29},[3245],{"type":48,"tag":665,"props":3246,"children":3247},{},[3248],{"type":53,"value":3249},"SHOW CLUSTER SETTING sql.log.user_audit;\n",{"type":48,"tag":665,"props":3251,"children":3252},{"class":667,"line":25},[3253],{"type":48,"tag":665,"props":3254,"children":3255},{"emptyLinePlaceholder":700},[3256],{"type":53,"value":703},{"type":48,"tag":665,"props":3258,"children":3259},{"class":667,"line":706},[3260],{"type":48,"tag":665,"props":3261,"children":3262},{},[3263],{"type":53,"value":3264},"-- Check admin audit logging\n",{"type":48,"tag":665,"props":3266,"children":3267},{"class":667,"line":715},[3268],{"type":48,"tag":665,"props":3269,"children":3270},{},[3271],{"type":53,"value":3272},"SHOW CLUSTER SETTING sql.log.admin_audit.enabled;\n",{"type":48,"tag":56,"props":3274,"children":3275},{},[3276],{"type":48,"tag":65,"props":3277,"children":3278},{},[3279],{"type":53,"value":2524},{"type":48,"tag":80,"props":3281,"children":3282},{},[3283,3311,3320],{"type":48,"tag":84,"props":3284,"children":3285},{},[3286,3290,3291,3297,3299,3305,3306],{"type":48,"tag":65,"props":3287,"children":3288},{},[3289],{"type":53,"value":1876},{"type":53,"value":1878},{"type":48,"tag":168,"props":3292,"children":3294},{"className":3293},[],[3295],{"type":53,"value":3296},"sql.log.user_audit",{"type":53,"value":3298}," is empty and ",{"type":48,"tag":168,"props":3300,"children":3302},{"className":3301},[],[3303],{"type":53,"value":3304},"sql.log.admin_audit.enabled",{"type":53,"value":2094},{"type":48,"tag":168,"props":3307,"children":3309},{"className":3308},[],[3310],{"type":53,"value":2100},{"type":48,"tag":84,"props":3312,"children":3313},{},[3314,3318],{"type":48,"tag":65,"props":3315,"children":3316},{},[3317],{"type":53,"value":1894},{"type":53,"value":3319}," if only admin audit is enabled but user audit is not configured",{"type":48,"tag":84,"props":3321,"children":3322},{},[3323,3327],{"type":48,"tag":65,"props":3324,"children":3325},{},[3326],{"type":53,"value":1938},{"type":53,"value":3328}," if both user and admin audit logging are configured",{"type":48,"tag":634,"props":3330,"children":3332},{"id":3331},"step-8-assess-backup-status",[3333],{"type":53,"value":3334},"Step 8: Assess Backup Status",{"type":48,"tag":56,"props":3336,"children":3337},{},[3338,3342],{"type":48,"tag":65,"props":3339,"children":3340},{},[3341],{"type":53,"value":652},{"type":53,"value":3343}," Managed backups are automatic — always PASS. Optionally check for self-managed schedules:",{"type":48,"tag":654,"props":3345,"children":3347},{"className":656,"code":3346,"language":658,"meta":659,"style":659},"ccloud cluster info \u003Ccluster-name> -o json  # Look for backup_config\n",[3348],{"type":48,"tag":168,"props":3349,"children":3350},{"__ignoreMap":659},[3351],{"type":48,"tag":665,"props":3352,"children":3353},{"class":667,"line":668},[3354,3358,3362,3366,3370,3374,3378,3382,3386,3391],{"type":48,"tag":665,"props":3355,"children":3356},{"style":681},[3357],{"type":53,"value":173},{"type":48,"tag":665,"props":3359,"children":3360},{"style":686},[3361],{"type":53,"value":725},{"type":48,"tag":665,"props":3363,"children":3364},{"style":686},[3365],{"type":53,"value":1130},{"type":48,"tag":665,"props":3367,"children":3368},{"style":784},[3369],{"type":53,"value":1135},{"type":48,"tag":665,"props":3371,"children":3372},{"style":686},[3373],{"type":53,"value":1140},{"type":48,"tag":665,"props":3375,"children":3376},{"style":1143},[3377],{"type":53,"value":1146},{"type":48,"tag":665,"props":3379,"children":3380},{"style":784},[3381],{"type":53,"value":1151},{"type":48,"tag":665,"props":3383,"children":3384},{"style":686},[3385],{"type":53,"value":735},{"type":48,"tag":665,"props":3387,"children":3388},{"style":686},[3389],{"type":53,"value":3390}," json",{"type":48,"tag":665,"props":3392,"children":3393},{"style":672},[3394],{"type":53,"value":3395},"  # Look for backup_config\n",{"type":48,"tag":654,"props":3397,"children":3399},{"className":1836,"code":3398,"language":517,"meta":659,"style":659},"SHOW SCHEDULES;  -- Check for additional self-managed backup schedules\n",[3400],{"type":48,"tag":168,"props":3401,"children":3402},{"__ignoreMap":659},[3403],{"type":48,"tag":665,"props":3404,"children":3405},{"class":667,"line":668},[3406],{"type":48,"tag":665,"props":3407,"children":3408},{},[3409],{"type":53,"value":3398},{"type":48,"tag":56,"props":3411,"children":3412},{},[3413,3417],{"type":48,"tag":65,"props":3414,"children":3415},{},[3416],{"type":53,"value":1167},{"type":53,"value":3418}," No managed backups — verify self-managed backup schedules:",{"type":48,"tag":654,"props":3420,"children":3422},{"className":1836,"code":3421,"language":517,"meta":659,"style":659},"SHOW SCHEDULES;\nSELECT id, label, schedule_status, next_run, created\nFROM [SHOW SCHEDULES]\nWHERE label ILIKE '%backup%' OR command @> '{\"backup\":{}}';\n",[3423],{"type":48,"tag":168,"props":3424,"children":3425},{"__ignoreMap":659},[3426,3434,3442,3450],{"type":48,"tag":665,"props":3427,"children":3428},{"class":667,"line":668},[3429],{"type":48,"tag":665,"props":3430,"children":3431},{},[3432],{"type":53,"value":3433},"SHOW SCHEDULES;\n",{"type":48,"tag":665,"props":3435,"children":3436},{"class":667,"line":29},[3437],{"type":48,"tag":665,"props":3438,"children":3439},{},[3440],{"type":53,"value":3441},"SELECT id, label, schedule_status, next_run, created\n",{"type":48,"tag":665,"props":3443,"children":3444},{"class":667,"line":25},[3445],{"type":48,"tag":665,"props":3446,"children":3447},{},[3448],{"type":53,"value":3449},"FROM [SHOW SCHEDULES]\n",{"type":48,"tag":665,"props":3451,"children":3452},{"class":667,"line":706},[3453],{"type":48,"tag":665,"props":3454,"children":3455},{},[3456],{"type":53,"value":3457},"WHERE label ILIKE '%backup%' OR command @> '{\"backup\":{}}';\n",{"type":48,"tag":80,"props":3459,"children":3460},{},[3461,3470,3479],{"type":48,"tag":84,"props":3462,"children":3463},{},[3464,3468],{"type":48,"tag":65,"props":3465,"children":3466},{},[3467],{"type":53,"value":1876},{"type":53,"value":3469}," if no backup schedules exist",{"type":48,"tag":84,"props":3471,"children":3472},{},[3473,3477],{"type":48,"tag":65,"props":3474,"children":3475},{},[3476],{"type":53,"value":1894},{"type":53,"value":3478}," if schedules exist but show errors or haven't run recently",{"type":48,"tag":84,"props":3480,"children":3481},{},[3482,3486],{"type":48,"tag":65,"props":3483,"children":3484},{},[3485],{"type":53,"value":1938},{"type":53,"value":3487}," if schedules are active and running",{"type":48,"tag":56,"props":3489,"children":3490},{},[3491],{"type":48,"tag":65,"props":3492,"children":3493},{},[3494],{"type":53,"value":2929},{"type":48,"tag":654,"props":3496,"children":3498},{"className":1836,"code":3497,"language":517,"meta":659,"style":659},"CREATE SCHEDULE 'nightly-full-backup'\n  FOR BACKUP INTO 'gs:\u002F\u002Fbucket\u002Fbackups'\n  RECURRING '@daily'\n  WITH SCHEDULE OPTIONS first_run = 'now';\n",[3499],{"type":48,"tag":168,"props":3500,"children":3501},{"__ignoreMap":659},[3502,3510,3518,3526],{"type":48,"tag":665,"props":3503,"children":3504},{"class":667,"line":668},[3505],{"type":48,"tag":665,"props":3506,"children":3507},{},[3508],{"type":53,"value":3509},"CREATE SCHEDULE 'nightly-full-backup'\n",{"type":48,"tag":665,"props":3511,"children":3512},{"class":667,"line":29},[3513],{"type":48,"tag":665,"props":3514,"children":3515},{},[3516],{"type":53,"value":3517},"  FOR BACKUP INTO 'gs:\u002F\u002Fbucket\u002Fbackups'\n",{"type":48,"tag":665,"props":3519,"children":3520},{"class":667,"line":25},[3521],{"type":48,"tag":665,"props":3522,"children":3523},{},[3524],{"type":53,"value":3525},"  RECURRING '@daily'\n",{"type":48,"tag":665,"props":3527,"children":3528},{"class":667,"line":706},[3529],{"type":48,"tag":665,"props":3530,"children":3531},{},[3532],{"type":53,"value":3533},"  WITH SCHEDULE OPTIONS first_run = 'now';\n",{"type":48,"tag":73,"props":3535,"children":3537},{"id":3536},"passwarnfail-criteria",[3538],{"type":53,"value":3539},"Pass\u002FWarn\u002FFail Criteria",{"type":48,"tag":124,"props":3541,"children":3542},{},[3543,3565],{"type":48,"tag":128,"props":3544,"children":3545},{},[3546],{"type":48,"tag":132,"props":3547,"children":3548},{},[3549,3553,3557,3561],{"type":48,"tag":136,"props":3550,"children":3551},{},[3552],{"type":53,"value":1378},{"type":48,"tag":136,"props":3554,"children":3555},{},[3556],{"type":53,"value":1938},{"type":48,"tag":136,"props":3558,"children":3559},{},[3560],{"type":53,"value":1894},{"type":48,"tag":136,"props":3562,"children":3563},{},[3564],{"type":53,"value":1876},{"type":48,"tag":157,"props":3566,"children":3567},{},[3568,3596,3618,3640,3661,3682,3705,3728,3749,3770,3793,3816,3836,3858,3880,3903,3924],{"type":48,"tag":132,"props":3569,"children":3570},{},[3571,3576,3581,3586],{"type":48,"tag":164,"props":3572,"children":3573},{},[3574],{"type":53,"value":3575},"IP Allowlist",{"type":48,"tag":164,"props":3577,"children":3578},{},[3579],{"type":53,"value":3580},"Specific CIDRs only",{"type":48,"tag":164,"props":3582,"children":3583},{},[3584],{"type":53,"value":3585},"Broad ranges (\u002F8, \u002F16)",{"type":48,"tag":164,"props":3587,"children":3588},{},[3589,3594],{"type":48,"tag":168,"props":3590,"children":3592},{"className":3591},[],[3593],{"type":53,"value":1884},{"type":53,"value":3595}," present",{"type":48,"tag":132,"props":3597,"children":3598},{},[3599,3603,3608,3613],{"type":48,"tag":164,"props":3600,"children":3601},{},[3602],{"type":53,"value":1467},{"type":48,"tag":164,"props":3604,"children":3605},{},[3606],{"type":53,"value":3607},"SSO enabled + enforced",{"type":48,"tag":164,"props":3609,"children":3610},{},[3611],{"type":53,"value":3612},"SSO enabled, not enforced",{"type":48,"tag":164,"props":3614,"children":3615},{},[3616],{"type":53,"value":3617},"Not configured",{"type":48,"tag":132,"props":3619,"children":3620},{},[3621,3626,3631,3636],{"type":48,"tag":164,"props":3622,"children":3623},{},[3624],{"type":53,"value":3625},"Database SSO",{"type":48,"tag":164,"props":3627,"children":3628},{},[3629],{"type":53,"value":3630},"Cluster SSO enabled",{"type":48,"tag":164,"props":3632,"children":3633},{},[3634],{"type":53,"value":3635},"—",{"type":48,"tag":164,"props":3637,"children":3638},{},[3639],{"type":53,"value":3617},{"type":48,"tag":132,"props":3641,"children":3642},{},[3643,3647,3652,3656],{"type":48,"tag":164,"props":3644,"children":3645},{},[3646],{"type":53,"value":1483},{"type":48,"tag":164,"props":3648,"children":3649},{},[3650],{"type":53,"value":3651},"SCIM enabled + connected",{"type":48,"tag":164,"props":3653,"children":3654},{},[3655],{"type":53,"value":3635},{"type":48,"tag":164,"props":3657,"children":3658},{},[3659],{"type":53,"value":3660},"Not enabled",{"type":48,"tag":132,"props":3662,"children":3663},{},[3664,3669,3674,3678],{"type":48,"tag":164,"props":3665,"children":3666},{},[3667],{"type":53,"value":3668},"DB Auto User Provisioning",{"type":48,"tag":164,"props":3670,"children":3671},{},[3672],{"type":53,"value":3673},"Identity mapping configured",{"type":48,"tag":164,"props":3675,"children":3676},{},[3677],{"type":53,"value":3635},{"type":48,"tag":164,"props":3679,"children":3680},{},[3681],{"type":53,"value":3617},{"type":48,"tag":132,"props":3683,"children":3684},{},[3685,3690,3695,3700],{"type":48,"tag":164,"props":3686,"children":3687},{},[3688],{"type":53,"value":3689},"Admin Users",{"type":48,"tag":164,"props":3691,"children":3692},{},[3693],{"type":53,"value":3694},"1-2 admins",{"type":48,"tag":164,"props":3696,"children":3697},{},[3698],{"type":53,"value":3699},"3-5 admins",{"type":48,"tag":164,"props":3701,"children":3702},{},[3703],{"type":53,"value":3704},"6+ admins",{"type":48,"tag":132,"props":3706,"children":3707},{},[3708,3713,3718,3723],{"type":48,"tag":164,"props":3709,"children":3710},{},[3711],{"type":53,"value":3712},"PUBLIC Privileges",{"type":48,"tag":164,"props":3714,"children":3715},{},[3716],{"type":53,"value":3717},"No data grants",{"type":48,"tag":164,"props":3719,"children":3720},{},[3721],{"type":53,"value":3722},"USAGE-only grants",{"type":48,"tag":164,"props":3724,"children":3725},{},[3726],{"type":53,"value":3727},"SELECT\u002FINSERT\u002FUPDATE\u002FDELETE",{"type":48,"tag":132,"props":3729,"children":3730},{},[3731,3736,3740,3744],{"type":48,"tag":164,"props":3732,"children":3733},{},[3734],{"type":53,"value":3735},"CMEK (Standard)",{"type":48,"tag":164,"props":3737,"children":3738},{},[3739],{"type":53,"value":185},{"type":48,"tag":164,"props":3741,"children":3742},{},[3743],{"type":53,"value":3635},{"type":48,"tag":164,"props":3745,"children":3746},{},[3747],{"type":53,"value":3748},"— (INFO: upgrade path)",{"type":48,"tag":132,"props":3750,"children":3751},{},[3752,3757,3762,3766],{"type":48,"tag":164,"props":3753,"children":3754},{},[3755],{"type":53,"value":3756},"CMEK (Advanced + Security Add-on)",{"type":48,"tag":164,"props":3758,"children":3759},{},[3760],{"type":53,"value":3761},"CMEK enabled",{"type":48,"tag":164,"props":3763,"children":3764},{},[3765],{"type":53,"value":3635},{"type":48,"tag":164,"props":3767,"children":3768},{},[3769],{"type":53,"value":3660},{"type":48,"tag":132,"props":3771,"children":3772},{},[3773,3778,3783,3788],{"type":48,"tag":164,"props":3774,"children":3775},{},[3776],{"type":53,"value":3777},"Enterprise Encryption (self-hosted)",{"type":48,"tag":164,"props":3779,"children":3780},{},[3781],{"type":53,"value":3782},"AES-256 enabled",{"type":48,"tag":164,"props":3784,"children":3785},{},[3786],{"type":53,"value":3787},"Cannot determine",{"type":48,"tag":164,"props":3789,"children":3790},{},[3791],{"type":53,"value":3792},"Not enabled (sensitive data)",{"type":48,"tag":132,"props":3794,"children":3795},{},[3796,3801,3806,3811],{"type":48,"tag":164,"props":3797,"children":3798},{},[3799],{"type":53,"value":3800},"TLS (self-hosted)",{"type":48,"tag":164,"props":3802,"children":3803},{},[3804],{"type":53,"value":3805},"Certs valid 90+ days",{"type":48,"tag":164,"props":3807,"children":3808},{},[3809],{"type":53,"value":3810},"Certs expire in 30-90 days",{"type":48,"tag":164,"props":3812,"children":3813},{},[3814],{"type":53,"value":3815},"Certs expire within 30 days",{"type":48,"tag":132,"props":3817,"children":3818},{},[3819,3823,3827,3831],{"type":48,"tag":164,"props":3820,"children":3821},{},[3822],{"type":53,"value":1615},{"type":48,"tag":164,"props":3824,"children":3825},{},[3826],{"type":53,"value":3635},{"type":48,"tag":164,"props":3828,"children":3829},{},[3830],{"type":53,"value":3635},{"type":48,"tag":164,"props":3832,"children":3833},{},[3834],{"type":53,"value":3835},"— (INFO only)",{"type":48,"tag":132,"props":3837,"children":3838},{},[3839,3844,3849,3854],{"type":48,"tag":164,"props":3840,"children":3841},{},[3842],{"type":53,"value":3843},"HBA (self-hosted)",{"type":48,"tag":164,"props":3845,"children":3846},{},[3847],{"type":53,"value":3848},"Restrictive rules",{"type":48,"tag":164,"props":3850,"children":3851},{},[3852],{"type":53,"value":3853},"Empty\u002Fdefault",{"type":48,"tag":164,"props":3855,"children":3856},{},[3857],{"type":53,"value":3635},{"type":48,"tag":132,"props":3859,"children":3860},{},[3861,3865,3870,3875],{"type":48,"tag":164,"props":3862,"children":3863},{},[3864],{"type":53,"value":547},{"type":48,"tag":164,"props":3866,"children":3867},{},[3868],{"type":53,"value":3869},"User + admin audit on",{"type":48,"tag":164,"props":3871,"children":3872},{},[3873],{"type":53,"value":3874},"Admin audit only",{"type":48,"tag":164,"props":3876,"children":3877},{},[3878],{"type":53,"value":3879},"Disabled",{"type":48,"tag":132,"props":3881,"children":3882},{},[3883,3888,3893,3898],{"type":48,"tag":164,"props":3884,"children":3885},{},[3886],{"type":53,"value":3887},"Password Policy",{"type":48,"tag":164,"props":3889,"children":3890},{},[3891],{"type":53,"value":3892},"min length >= 12",{"type":48,"tag":164,"props":3894,"children":3895},{},[3896],{"type":53,"value":3897},"min length 8-11",{"type":48,"tag":164,"props":3899,"children":3900},{},[3901],{"type":53,"value":3902},"min length \u003C 8",{"type":48,"tag":132,"props":3904,"children":3905},{},[3906,3911,3915,3919],{"type":48,"tag":164,"props":3907,"children":3908},{},[3909],{"type":53,"value":3910},"Backups (Cloud)",{"type":48,"tag":164,"props":3912,"children":3913},{},[3914],{"type":53,"value":185},{"type":48,"tag":164,"props":3916,"children":3917},{},[3918],{"type":53,"value":3635},{"type":48,"tag":164,"props":3920,"children":3921},{},[3922],{"type":53,"value":3923},"— (INFO: managed)",{"type":48,"tag":132,"props":3925,"children":3926},{},[3927,3932,3937,3942],{"type":48,"tag":164,"props":3928,"children":3929},{},[3930],{"type":53,"value":3931},"Backups (self-hosted)",{"type":48,"tag":164,"props":3933,"children":3934},{},[3935],{"type":53,"value":3936},"Schedules active",{"type":48,"tag":164,"props":3938,"children":3939},{},[3940],{"type":53,"value":3941},"Schedules have errors",{"type":48,"tag":164,"props":3943,"children":3944},{},[3945],{"type":53,"value":3946},"No schedules exist",{"type":48,"tag":73,"props":3948,"children":3950},{"id":3949},"severity-adjustments-by-environment",[3951],{"type":53,"value":3952},"Severity Adjustments by Environment",{"type":48,"tag":56,"props":3954,"children":3955},{},[3956],{"type":53,"value":3957},"Severity is calibrated for production by default. Non-production environments downgrade some findings. Compliance requirements override downgrades.",{"type":48,"tag":124,"props":3959,"children":3960},{},[3961,3991],{"type":48,"tag":128,"props":3962,"children":3963},{},[3964],{"type":48,"tag":132,"props":3965,"children":3966},{},[3967,3971,3976,3981,3986],{"type":48,"tag":136,"props":3968,"children":3969},{},[3970],{"type":53,"value":1378},{"type":48,"tag":136,"props":3972,"children":3973},{},[3974],{"type":53,"value":3975},"Production",{"type":48,"tag":136,"props":3977,"children":3978},{},[3979],{"type":53,"value":3980},"Staging",{"type":48,"tag":136,"props":3982,"children":3983},{},[3984],{"type":53,"value":3985},"Development",{"type":48,"tag":136,"props":3987,"children":3988},{},[3989],{"type":53,"value":3990},"Sandbox",{"type":48,"tag":157,"props":3992,"children":3993},{},[3994,4025,4049,4073,4097,4121,4145,4169,4193,4217,4241],{"type":48,"tag":132,"props":3995,"children":3996},{},[3997,4009,4013,4017,4021],{"type":48,"tag":164,"props":3998,"children":3999},{},[4000,4002,4007],{"type":53,"value":4001},"IP allowlist ",{"type":48,"tag":168,"props":4003,"children":4005},{"className":4004},[],[4006],{"type":53,"value":1884},{"type":53,"value":4008}," (Cloud)",{"type":48,"tag":164,"props":4010,"children":4011},{},[4012],{"type":53,"value":1876},{"type":48,"tag":164,"props":4014,"children":4015},{},[4016],{"type":53,"value":1876},{"type":48,"tag":164,"props":4018,"children":4019},{},[4020],{"type":53,"value":1894},{"type":48,"tag":164,"props":4022,"children":4023},{},[4024],{"type":53,"value":1894},{"type":48,"tag":132,"props":4026,"children":4027},{},[4028,4033,4037,4041,4045],{"type":48,"tag":164,"props":4029,"children":4030},{},[4031],{"type":53,"value":4032},"No private endpoints on Advanced (Cloud)",{"type":48,"tag":164,"props":4034,"children":4035},{},[4036],{"type":53,"value":1894},{"type":48,"tag":164,"props":4038,"children":4039},{},[4040],{"type":53,"value":1894},{"type":48,"tag":164,"props":4042,"children":4043},{},[4044],{"type":53,"value":1928},{"type":48,"tag":164,"props":4046,"children":4047},{},[4048],{"type":53,"value":1928},{"type":48,"tag":132,"props":4050,"children":4051},{},[4052,4057,4061,4065,4069],{"type":48,"tag":164,"props":4053,"children":4054},{},[4055],{"type":53,"value":4056},"Empty HBA conf (self-hosted)",{"type":48,"tag":164,"props":4058,"children":4059},{},[4060],{"type":53,"value":1894},{"type":48,"tag":164,"props":4062,"children":4063},{},[4064],{"type":53,"value":1894},{"type":48,"tag":164,"props":4066,"children":4067},{},[4068],{"type":53,"value":1928},{"type":48,"tag":164,"props":4070,"children":4071},{},[4072],{"type":53,"value":1928},{"type":48,"tag":132,"props":4074,"children":4075},{},[4076,4081,4085,4089,4093],{"type":48,"tag":164,"props":4077,"children":4078},{},[4079],{"type":53,"value":4080},"SSO not configured",{"type":48,"tag":164,"props":4082,"children":4083},{},[4084],{"type":53,"value":1876},{"type":48,"tag":164,"props":4086,"children":4087},{},[4088],{"type":53,"value":1876},{"type":48,"tag":164,"props":4090,"children":4091},{},[4092],{"type":53,"value":1928},{"type":48,"tag":164,"props":4094,"children":4095},{},[4096],{"type":53,"value":1928},{"type":48,"tag":132,"props":4098,"children":4099},{},[4100,4105,4109,4113,4117],{"type":48,"tag":164,"props":4101,"children":4102},{},[4103],{"type":53,"value":4104},"SCIM not enabled",{"type":48,"tag":164,"props":4106,"children":4107},{},[4108],{"type":53,"value":1876},{"type":48,"tag":164,"props":4110,"children":4111},{},[4112],{"type":53,"value":1876},{"type":48,"tag":164,"props":4114,"children":4115},{},[4116],{"type":53,"value":1928},{"type":48,"tag":164,"props":4118,"children":4119},{},[4120],{"type":53,"value":1928},{"type":48,"tag":132,"props":4122,"children":4123},{},[4124,4129,4133,4137,4141],{"type":48,"tag":164,"props":4125,"children":4126},{},[4127],{"type":53,"value":4128},"Database SSO disabled",{"type":48,"tag":164,"props":4130,"children":4131},{},[4132],{"type":53,"value":1876},{"type":48,"tag":164,"props":4134,"children":4135},{},[4136],{"type":53,"value":1876},{"type":48,"tag":164,"props":4138,"children":4139},{},[4140],{"type":53,"value":1928},{"type":48,"tag":164,"props":4142,"children":4143},{},[4144],{"type":53,"value":1928},{"type":48,"tag":132,"props":4146,"children":4147},{},[4148,4153,4157,4161,4165],{"type":48,"tag":164,"props":4149,"children":4150},{},[4151],{"type":53,"value":4152},"Admin count 6+",{"type":48,"tag":164,"props":4154,"children":4155},{},[4156],{"type":53,"value":1876},{"type":48,"tag":164,"props":4158,"children":4159},{},[4160],{"type":53,"value":1876},{"type":48,"tag":164,"props":4162,"children":4163},{},[4164],{"type":53,"value":1894},{"type":48,"tag":164,"props":4166,"children":4167},{},[4168],{"type":53,"value":1894},{"type":48,"tag":132,"props":4170,"children":4171},{},[4172,4177,4181,4185,4189],{"type":48,"tag":164,"props":4173,"children":4174},{},[4175],{"type":53,"value":4176},"CMEK not enabled (Cloud)",{"type":48,"tag":164,"props":4178,"children":4179},{},[4180],{"type":53,"value":1876},{"type":48,"tag":164,"props":4182,"children":4183},{},[4184],{"type":53,"value":1876},{"type":48,"tag":164,"props":4186,"children":4187},{},[4188],{"type":53,"value":1894},{"type":48,"tag":164,"props":4190,"children":4191},{},[4192],{"type":53,"value":1894},{"type":48,"tag":132,"props":4194,"children":4195},{},[4196,4201,4205,4209,4213],{"type":48,"tag":164,"props":4197,"children":4198},{},[4199],{"type":53,"value":4200},"Enterprise Encryption not enabled (self-hosted)",{"type":48,"tag":164,"props":4202,"children":4203},{},[4204],{"type":53,"value":1876},{"type":48,"tag":164,"props":4206,"children":4207},{},[4208],{"type":53,"value":1876},{"type":48,"tag":164,"props":4210,"children":4211},{},[4212],{"type":53,"value":1894},{"type":48,"tag":164,"props":4214,"children":4215},{},[4216],{"type":53,"value":1894},{"type":48,"tag":132,"props":4218,"children":4219},{},[4220,4225,4229,4233,4237],{"type":48,"tag":164,"props":4221,"children":4222},{},[4223],{"type":53,"value":4224},"Audit logging disabled",{"type":48,"tag":164,"props":4226,"children":4227},{},[4228],{"type":53,"value":1876},{"type":48,"tag":164,"props":4230,"children":4231},{},[4232],{"type":53,"value":1876},{"type":48,"tag":164,"props":4234,"children":4235},{},[4236],{"type":53,"value":1894},{"type":48,"tag":164,"props":4238,"children":4239},{},[4240],{"type":53,"value":1928},{"type":48,"tag":132,"props":4242,"children":4243},{},[4244,4249,4253,4257,4261],{"type":48,"tag":164,"props":4245,"children":4246},{},[4247],{"type":53,"value":4248},"No backup schedules (self-hosted)",{"type":48,"tag":164,"props":4250,"children":4251},{},[4252],{"type":53,"value":1876},{"type":48,"tag":164,"props":4254,"children":4255},{},[4256],{"type":53,"value":1876},{"type":48,"tag":164,"props":4258,"children":4259},{},[4260],{"type":53,"value":1894},{"type":48,"tag":164,"props":4262,"children":4263},{},[4264],{"type":53,"value":1928},{"type":48,"tag":56,"props":4266,"children":4267},{},[4268,4273],{"type":48,"tag":65,"props":4269,"children":4270},{},[4271],{"type":53,"value":4272},"Compliance overrides",{"type":53,"value":4274}," — these checks cannot be downgraded when a compliance framework is specified (compliance takes precedence over environment):",{"type":48,"tag":124,"props":4276,"children":4277},{},[4278,4294],{"type":48,"tag":128,"props":4279,"children":4280},{},[4281],{"type":48,"tag":132,"props":4282,"children":4283},{},[4284,4289],{"type":48,"tag":136,"props":4285,"children":4286},{},[4287],{"type":53,"value":4288},"Framework",{"type":48,"tag":136,"props":4290,"children":4291},{},[4292],{"type":53,"value":4293},"Non-Downgradable Checks",{"type":48,"tag":157,"props":4295,"children":4296},{},[4297,4310,4323,4336,4349],{"type":48,"tag":132,"props":4298,"children":4299},{},[4300,4305],{"type":48,"tag":164,"props":4301,"children":4302},{},[4303],{"type":53,"value":4304},"SOC 2",{"type":48,"tag":164,"props":4306,"children":4307},{},[4308],{"type":53,"value":4309},"SSO, audit logging, admin users, password policy",{"type":48,"tag":132,"props":4311,"children":4312},{},[4313,4318],{"type":48,"tag":164,"props":4314,"children":4315},{},[4316],{"type":53,"value":4317},"HIPAA",{"type":48,"tag":164,"props":4319,"children":4320},{},[4321],{"type":53,"value":4322},"SSO, CMEK\u002FEnterprise Encryption, audit logging, encryption, password policy, backups",{"type":48,"tag":132,"props":4324,"children":4325},{},[4326,4331],{"type":48,"tag":164,"props":4327,"children":4328},{},[4329],{"type":53,"value":4330},"PCI DSS",{"type":48,"tag":164,"props":4332,"children":4333},{},[4334],{"type":53,"value":4335},"IP allowlist\u002FHBA, CMEK\u002FEnterprise Encryption, audit logging, admin users, password policy, backups",{"type":48,"tag":132,"props":4337,"children":4338},{},[4339,4344],{"type":48,"tag":164,"props":4340,"children":4341},{},[4342],{"type":53,"value":4343},"ISO 27001",{"type":48,"tag":164,"props":4345,"children":4346},{},[4347],{"type":53,"value":4348},"SSO, audit logging, admin users",{"type":48,"tag":132,"props":4350,"children":4351},{},[4352,4357],{"type":48,"tag":164,"props":4353,"children":4354},{},[4355],{"type":53,"value":4356},"GDPR",{"type":48,"tag":164,"props":4358,"children":4359},{},[4360],{"type":53,"value":4361},"Audit logging, encryption",{"type":48,"tag":56,"props":4363,"children":4364},{},[4365,4370,4371,4377,4378],{"type":48,"tag":65,"props":4366,"children":4367},{},[4368],{"type":53,"value":4369},"Annotations:",{"type":53,"value":2500},{"type":48,"tag":168,"props":4372,"children":4374},{"className":4373},[],[4375],{"type":53,"value":4376},"*(downgraded from FAIL — development cluster)*",{"type":53,"value":1904},{"type":48,"tag":168,"props":4379,"children":4381},{"className":4380},[],[4382],{"type":53,"value":4383},"*(PCI DSS compliance — cannot downgrade)*",{"type":48,"tag":73,"props":4385,"children":4387},{"id":4386},"report-format",[4388],{"type":53,"value":4389},"Report Format",{"type":48,"tag":56,"props":4391,"children":4392},{},[4393,4395,4401,4403,4409],{"type":53,"value":4394},"Save each audit report to ",{"type":48,"tag":168,"props":4396,"children":4398},{"className":4397},[],[4399],{"type":53,"value":4400},"reports\u002Fsecurity-audit-\u003Ccluster-name>-\u003CYYYY-MM-DD>-\u003Csequence>.md",{"type":53,"value":4402}," (gitignored, local-only). The ",{"type":48,"tag":168,"props":4404,"children":4406},{"className":4405},[],[4407],{"type":53,"value":4408},"reports\u002F",{"type":53,"value":4410}," directory is not committed to version control — it serves as a local log for historical comparison and remediation tracking.",{"type":48,"tag":56,"props":4412,"children":4413},{},[4414],{"type":53,"value":4415},"Generate a markdown report with the following structure:",{"type":48,"tag":654,"props":4417,"children":4421},{"className":4418,"code":4420,"language":53},[4419],"language-text","# Security Audit Report — \u003CCluster Name>\n\n**Date:** YYYY-MM-DD\n**Cluster ID:** \u003Ccluster-id>\n**Plan:** Standard | Advanced | Self-hosted\n**CockroachDB Version:** vXX.X.X\n**Regions:** us-east-1, us-west-2\n**Deployment:** CockroachDB Cloud | Self-hosted\n**Environment:** production | staging | development | sandbox\n**Compliance:** SOC 2, PCI DSS | (none specified)\n**Data Sensitivity:** PII\u002FPHI | financial | internal | public\n\n## Summary\n\n| Status | Count |\n|--------|-------|\n| PASS   | X     |\n| WARN   | X     |\n| FAIL   | X     |\n| INFO   | X     |\n| N\u002FA    | X     |\n\n## Findings\n\n### Network Security\n- [PASS|WARN|FAIL|N\u002FA] IP allowlist: \u003Cdetails>\n- [PASS|WARN|INFO|N\u002FA] Private endpoints: \u003Cdetails>\n- [PASS|WARN|N\u002FA] HBA configuration: \u003Cdetails>\n\n### Authentication & SSO\n- [PASS|FAIL|N\u002FA] Cloud Console SSO: \u003Cdetails>\n- [PASS|FAIL] Database SSO (OIDC): \u003Cdetails>\n- [PASS|INFO] Database SSO (LDAP\u002FAD): \u003Cdetails>\n- [PASS|FAIL|N\u002FA] SCIM 2.0 provisioning: \u003Cdetails>\n- [PASS|FAIL] Auto user provisioning: \u003Cdetails>\n\n### Authorization\n- [PASS|WARN|FAIL] Admin user count: X users with admin role\n- [PASS|FAIL] PUBLIC role privileges: \u003Cdetails>\n\n### Encryption\n- [PASS|FAIL|INFO|N\u002FA] CMEK: \u003Cdetails>\n- [PASS|FAIL|WARN|N\u002FA] Enterprise Encryption: \u003Cdetails>\n- [PASS|FAIL|N\u002FA] TLS: \u003Cdetails>\n- [INFO] Cryptographic posture: TLS version, PQC support, key size\n\n### Audit Logging\n- [PASS|WARN|FAIL] Audit log configuration: \u003Cdetails>\n\n### Backup & Recovery\n- [PASS|INFO|N\u002FA] Managed backups: \u003Cdetails>\n- [PASS|WARN|FAIL|N\u002FA] Self-managed backups: \u003Cdetails>\n\n### Cluster Configuration\n- [INFO] Version: vXX.X.X\n- [INFO] Plan: Standard | Advanced | Self-hosted\n- [INFO] Regions: \u003Clist>\n",[4422],{"type":48,"tag":168,"props":4423,"children":4424},{"__ignoreMap":659},[4425],{"type":53,"value":4420},{"type":48,"tag":56,"props":4427,"children":4428},{},[4429,4434,4435,4441,4442,4448,4449,4455,4456,4462,4463,4468,4470,4475],{"type":48,"tag":65,"props":4430,"children":4431},{},[4432],{"type":53,"value":4433},"Status markers:",{"type":53,"value":2500},{"type":48,"tag":168,"props":4436,"children":4438},{"className":4437},[],[4439],{"type":53,"value":4440},"[PASS]",{"type":53,"value":1041},{"type":48,"tag":168,"props":4443,"children":4445},{"className":4444},[],[4446],{"type":53,"value":4447},"[WARN]",{"type":53,"value":1041},{"type":48,"tag":168,"props":4450,"children":4452},{"className":4451},[],[4453],{"type":53,"value":4454},"[FAIL]",{"type":53,"value":1041},{"type":48,"tag":168,"props":4457,"children":4459},{"className":4458},[],[4460],{"type":53,"value":4461},"[INFO]",{"type":53,"value":1041},{"type":48,"tag":168,"props":4464,"children":4466},{"className":4465},[],[4467],{"type":53,"value":1686},{"type":53,"value":4469},". Use ",{"type":48,"tag":168,"props":4471,"children":4473},{"className":4472},[],[4474],{"type":53,"value":1686},{"type":53,"value":4476}," for checks that don't apply to the deployment model. Append severity adjustment annotations when applicable (see Severity Adjustments).",{"type":48,"tag":73,"props":4478,"children":4480},{"id":4479},"remediation",[4481],{"type":53,"value":4482},"Remediation",{"type":48,"tag":56,"props":4484,"children":4485},{},[4486],{"type":53,"value":4487},"For each finding, the corresponding remediation skill can be used independently:",{"type":48,"tag":124,"props":4489,"children":4490},{},[4491,4507],{"type":48,"tag":128,"props":4492,"children":4493},{},[4494],{"type":48,"tag":132,"props":4495,"children":4496},{},[4497,4502],{"type":48,"tag":136,"props":4498,"children":4499},{},[4500],{"type":53,"value":4501},"Finding",{"type":48,"tag":136,"props":4503,"children":4504},{},[4505],{"type":53,"value":4506},"Remediation Skill",{"type":48,"tag":157,"props":4508,"children":4509},{},[4510,4527,4544,4561,4577,4594,4611,4626,4643,4660],{"type":48,"tag":132,"props":4511,"children":4512},{},[4513,4518],{"type":48,"tag":164,"props":4514,"children":4515},{},[4516],{"type":53,"value":4517},"Open IP allowlist",{"type":48,"tag":164,"props":4519,"children":4520},{},[4521],{"type":48,"tag":430,"props":4522,"children":4524},{"href":4523},"..\u002Fconfiguring-ip-allowlists\u002FSKILL.md",[4525],{"type":53,"value":4526},"configuring-ip-allowlists",{"type":48,"tag":132,"props":4528,"children":4529},{},[4530,4535],{"type":48,"tag":164,"props":4531,"children":4532},{},[4533],{"type":53,"value":4534},"SSO not configured \u002F SCIM not enabled",{"type":48,"tag":164,"props":4536,"children":4537},{},[4538],{"type":48,"tag":430,"props":4539,"children":4541},{"href":4540},"..\u002Fconfiguring-sso-and-scim\u002FSKILL.md",[4542],{"type":53,"value":4543},"configuring-sso-and-scim",{"type":48,"tag":132,"props":4545,"children":4546},{},[4547,4552],{"type":48,"tag":164,"props":4548,"children":4549},{},[4550],{"type":53,"value":4551},"CMEK not enabled",{"type":48,"tag":164,"props":4553,"children":4554},{},[4555],{"type":48,"tag":430,"props":4556,"children":4558},{"href":4557},"..\u002Fenabling-cmek-encryption\u002FSKILL.md",[4559],{"type":53,"value":4560},"enabling-cmek-encryption",{"type":48,"tag":132,"props":4562,"children":4563},{},[4564,4568],{"type":48,"tag":164,"props":4565,"children":4566},{},[4567],{"type":53,"value":4224},{"type":48,"tag":164,"props":4569,"children":4570},{},[4571],{"type":48,"tag":430,"props":4572,"children":4574},{"href":4573},"..\u002Fconfiguring-audit-logging\u002FSKILL.md",[4575],{"type":53,"value":4576},"configuring-audit-logging",{"type":48,"tag":132,"props":4578,"children":4579},{},[4580,4585],{"type":48,"tag":164,"props":4581,"children":4582},{},[4583],{"type":53,"value":4584},"Excessive admin privileges",{"type":48,"tag":164,"props":4586,"children":4587},{},[4588],{"type":48,"tag":430,"props":4589,"children":4591},{"href":4590},"..\u002Fhardening-user-privileges\u002FSKILL.md",[4592],{"type":53,"value":4593},"hardening-user-privileges",{"type":48,"tag":132,"props":4595,"children":4596},{},[4597,4602],{"type":48,"tag":164,"props":4598,"children":4599},{},[4600],{"type":53,"value":4601},"Weak password policy",{"type":48,"tag":164,"props":4603,"children":4604},{},[4605],{"type":48,"tag":430,"props":4606,"children":4608},{"href":4607},"..\u002Fenforcing-password-policies\u002FSKILL.md",[4609],{"type":53,"value":4610},"enforcing-password-policies",{"type":48,"tag":132,"props":4612,"children":4613},{},[4614,4619],{"type":48,"tag":164,"props":4615,"children":4616},{},[4617],{"type":53,"value":4618},"TLS\u002Fcertificate issues",{"type":48,"tag":164,"props":4620,"children":4621},{},[4622],{"type":48,"tag":430,"props":4623,"children":4624},{"href":2933},[4625],{"type":53,"value":2936},{"type":48,"tag":132,"props":4627,"children":4628},{},[4629,4634],{"type":48,"tag":164,"props":4630,"children":4631},{},[4632],{"type":53,"value":4633},"No private connectivity",{"type":48,"tag":164,"props":4635,"children":4636},{},[4637],{"type":48,"tag":430,"props":4638,"children":4640},{"href":4639},"..\u002Fconfiguring-private-connectivity\u002FSKILL.md",[4641],{"type":53,"value":4642},"configuring-private-connectivity",{"type":48,"tag":132,"props":4644,"children":4645},{},[4646,4651],{"type":48,"tag":164,"props":4647,"children":4648},{},[4649],{"type":53,"value":4650},"Log export not configured",{"type":48,"tag":164,"props":4652,"children":4653},{},[4654],{"type":48,"tag":430,"props":4655,"children":4657},{"href":4656},"..\u002Fconfiguring-log-export\u002FSKILL.md",[4658],{"type":53,"value":4659},"configuring-log-export",{"type":48,"tag":132,"props":4661,"children":4662},{},[4663,4668],{"type":48,"tag":164,"props":4664,"children":4665},{},[4666],{"type":53,"value":4667},"Compliance gaps",{"type":48,"tag":164,"props":4669,"children":4670},{},[4671],{"type":48,"tag":430,"props":4672,"children":4674},{"href":4673},"..\u002Fpreparing-compliance-documentation\u002FSKILL.md",[4675],{"type":53,"value":4676},"preparing-compliance-documentation",{"type":48,"tag":56,"props":4678,"children":4679},{},[4680,4682,4687,4689,4694],{"type":53,"value":4681},"For each FAIL finding, offer: ",{"type":48,"tag":65,"props":4683,"children":4684},{},[4685],{"type":53,"value":4686},"\"Explain how to fix this\"",{"type":53,"value":4688}," (step-by-step guidance) or ",{"type":48,"tag":65,"props":4690,"children":4691},{},[4692],{"type":53,"value":4693},"\"Help me fix this now\"",{"type":53,"value":4695}," (interactive remediation).",{"type":48,"tag":73,"props":4697,"children":4699},{"id":4698},"safety-considerations",[4700],{"type":53,"value":4701},"Safety Considerations",{"type":48,"tag":80,"props":4703,"children":4704},{},[4705,4715,4725,4758,4768],{"type":48,"tag":84,"props":4706,"children":4707},{},[4708,4713],{"type":48,"tag":65,"props":4709,"children":4710},{},[4711],{"type":53,"value":4712},"All operations are read-only.",{"type":53,"value":4714}," No cluster settings, users, roles, or network configurations are modified during the audit.",{"type":48,"tag":84,"props":4716,"children":4717},{},[4718,4723],{"type":48,"tag":65,"props":4719,"children":4720},{},[4721],{"type":53,"value":4722},"SQL queries use SHOW and SELECT only.",{"type":53,"value":4724}," No DDL or DML statements are executed.",{"type":48,"tag":84,"props":4726,"children":4727},{},[4728,4733,4735,4741,4742,4748,4750,4756],{"type":48,"tag":65,"props":4729,"children":4730},{},[4731],{"type":53,"value":4732},"ccloud commands are read-only.",{"type":53,"value":4734}," Only ",{"type":48,"tag":168,"props":4736,"children":4738},{"className":4737},[],[4739],{"type":53,"value":4740},"list",{"type":53,"value":1041},{"type":48,"tag":168,"props":4743,"children":4745},{"className":4744},[],[4746],{"type":53,"value":4747},"info",{"type":53,"value":4749},", and ",{"type":48,"tag":168,"props":4751,"children":4753},{"className":4752},[],[4754],{"type":53,"value":4755},"auth",{"type":53,"value":4757}," subcommands are used.",{"type":48,"tag":84,"props":4759,"children":4760},{},[4761,4766],{"type":48,"tag":65,"props":4762,"children":4763},{},[4764],{"type":53,"value":4765},"No secrets are logged.",{"type":53,"value":4767}," Connection strings and tokens are not included in the report output.",{"type":48,"tag":84,"props":4769,"children":4770},{},[4771,4776],{"type":48,"tag":65,"props":4772,"children":4773},{},[4774],{"type":53,"value":4775},"Privilege check:",{"type":53,"value":4777}," The audit may produce incomplete results if the executing user lacks admin or VIEWACTIVITY privilege. The report notes any permission gaps.",{"type":48,"tag":73,"props":4779,"children":4781},{"id":4780},"references",[4782],{"type":53,"value":4783},"References",{"type":48,"tag":56,"props":4785,"children":4786},{},[4787],{"type":48,"tag":65,"props":4788,"children":4789},{},[4790],{"type":53,"value":4791},"Skill references:",{"type":48,"tag":80,"props":4793,"children":4794},{},[4795,4806,4814,4822],{"type":48,"tag":84,"props":4796,"children":4797},{},[4798,4804],{"type":48,"tag":430,"props":4799,"children":4801},{"href":4800},"references\u002Fsample-report.md",[4802],{"type":53,"value":4803},"Sample audit report",{"type":53,"value":4805}," — Example report with findings and remediation links",{"type":48,"tag":84,"props":4807,"children":4808},{},[4809],{"type":48,"tag":430,"props":4810,"children":4811},{"href":2331},[4812],{"type":53,"value":4813},"SQL queries for security auditing",{"type":48,"tag":84,"props":4815,"children":4816},{},[4817],{"type":48,"tag":430,"props":4818,"children":4819},{"href":1289},[4820],{"type":53,"value":4821},"ccloud CLI commands",{"type":48,"tag":84,"props":4823,"children":4824},{},[4825],{"type":48,"tag":430,"props":4826,"children":4827},{"href":432},[4828],{"type":53,"value":4829},"RBAC and privileges setup",{"type":48,"tag":56,"props":4831,"children":4832},{},[4833],{"type":48,"tag":65,"props":4834,"children":4835},{},[4836],{"type":53,"value":4837},"Remediation skills:",{"type":48,"tag":80,"props":4839,"children":4840},{},[4841,4850,4859,4868,4877,4886,4895,4904,4913,4922],{"type":48,"tag":84,"props":4842,"children":4843},{},[4844,4848],{"type":48,"tag":430,"props":4845,"children":4846},{"href":4523},[4847],{"type":53,"value":4526},{"type":53,"value":4849}," — Network access hardening",{"type":48,"tag":84,"props":4851,"children":4852},{},[4853,4857],{"type":48,"tag":430,"props":4854,"children":4855},{"href":4557},[4856],{"type":53,"value":4560},{"type":53,"value":4858}," — Customer-managed encryption keys",{"type":48,"tag":84,"props":4860,"children":4861},{},[4862,4866],{"type":48,"tag":430,"props":4863,"children":4864},{"href":4573},[4865],{"type":53,"value":4576},{"type":53,"value":4867}," — SQL audit logging",{"type":48,"tag":84,"props":4869,"children":4870},{},[4871,4875],{"type":48,"tag":430,"props":4872,"children":4873},{"href":4590},[4874],{"type":53,"value":4593},{"type":53,"value":4876}," — RBAC tightening",{"type":48,"tag":84,"props":4878,"children":4879},{},[4880,4884],{"type":48,"tag":430,"props":4881,"children":4882},{"href":4607},[4883],{"type":53,"value":4610},{"type":53,"value":4885}," — Password strength enforcement",{"type":48,"tag":84,"props":4887,"children":4888},{},[4889,4893],{"type":48,"tag":430,"props":4890,"children":4891},{"href":4540},[4892],{"type":53,"value":4543},{"type":53,"value":4894}," — SSO and SCIM provisioning",{"type":48,"tag":84,"props":4896,"children":4897},{},[4898,4902],{"type":48,"tag":430,"props":4899,"children":4900},{"href":2933},[4901],{"type":53,"value":2936},{"type":53,"value":4903}," — TLS certificate management",{"type":48,"tag":84,"props":4905,"children":4906},{},[4907,4911],{"type":48,"tag":430,"props":4908,"children":4909},{"href":4639},[4910],{"type":53,"value":4642},{"type":53,"value":4912}," — Private endpoints and VPC peering",{"type":48,"tag":84,"props":4914,"children":4915},{},[4916,4920],{"type":48,"tag":430,"props":4917,"children":4918},{"href":4656},[4919],{"type":53,"value":4659},{"type":53,"value":4921}," — Log and metric export",{"type":48,"tag":84,"props":4923,"children":4924},{},[4925,4929],{"type":48,"tag":430,"props":4926,"children":4927},{"href":4673},[4928],{"type":53,"value":4676},{"type":53,"value":4930}," — Compliance readiness and documentation",{"type":48,"tag":56,"props":4932,"children":4933},{},[4934],{"type":48,"tag":65,"props":4935,"children":4936},{},[4937],{"type":53,"value":4938},"Official CockroachDB Documentation:",{"type":48,"tag":80,"props":4940,"children":4941},{},[4942,4953,4963,4972,4982,4992,5002,5011],{"type":48,"tag":84,"props":4943,"children":4944},{},[4945],{"type":48,"tag":430,"props":4946,"children":4950},{"href":4947,"rel":4948},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fsecurity-overview.html",[4949],"nofollow",[4951],{"type":53,"value":4952},"CockroachDB Cloud Security Overview",{"type":48,"tag":84,"props":4954,"children":4955},{},[4956],{"type":48,"tag":430,"props":4957,"children":4960},{"href":4958,"rel":4959},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html",[4949],[4961],{"type":53,"value":4962},"Managing IP Allowlists",{"type":48,"tag":84,"props":4964,"children":4965},{},[4966],{"type":48,"tag":430,"props":4967,"children":4970},{"href":4968,"rel":4969},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcloud-org-sso.html",[4949],[4971],{"type":53,"value":1467},{"type":48,"tag":84,"props":4973,"children":4974},{},[4975],{"type":48,"tag":430,"props":4976,"children":4979},{"href":4977,"rel":4978},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsso-sql.html",[4949],[4980],{"type":53,"value":4981},"Cluster SSO (Database SSO)",{"type":48,"tag":84,"props":4983,"children":4984},{},[4985],{"type":48,"tag":430,"props":4986,"children":4989},{"href":4987,"rel":4988},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fconfigure-scim-provisioning",[4949],[4990],{"type":53,"value":4991},"SCIM Provisioning",{"type":48,"tag":84,"props":4993,"children":4994},{},[4995],{"type":48,"tag":430,"props":4996,"children":4999},{"href":4997,"rel":4998},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcmek.html",[4949],[5000],{"type":53,"value":5001},"CMEK Overview",{"type":48,"tag":84,"props":5003,"children":5004},{},[5005],{"type":48,"tag":430,"props":5006,"children":5009},{"href":5007,"rel":5008},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsql-audit-logging.html",[4949],[5010],{"type":53,"value":547},{"type":48,"tag":84,"props":5012,"children":5013},{},[5014],{"type":48,"tag":430,"props":5015,"children":5018},{"href":5016,"rel":5017},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthorization.html",[4949],[5019],{"type":53,"value":5020},"Security Reference: Authorization",{"type":48,"tag":5022,"props":5023,"children":5024},"style",{},[5025],{"type":53,"value":5026},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":5028,"total":5113},[5029,5043,5057,5070,5077,5090,5103],{"slug":5030,"name":5030,"fn":5031,"description":5032,"org":5033,"tags":5034,"stars":25,"repoUrl":26,"updatedAt":5042},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5035,5036,5039],{"name":23,"slug":24,"type":15},{"name":5037,"slug":5038,"type":15},"Monitoring","monitoring",{"name":5040,"slug":5041,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":5044,"name":5044,"fn":5045,"description":5046,"org":5047,"tags":5048,"stars":25,"repoUrl":26,"updatedAt":5056},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5049,5052,5053,5054],{"name":5050,"slug":5051,"type":15},"Data Modeling","data-modeling",{"name":23,"slug":24,"type":15},{"name":5040,"slug":5041,"type":15},{"name":5055,"slug":517,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":5058,"name":5058,"fn":5059,"description":5060,"org":5061,"tags":5062,"stars":25,"repoUrl":26,"updatedAt":5069},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5063,5064,5067,5068],{"name":20,"slug":21,"type":15},{"name":5065,"slug":5066,"type":15},"Compliance","compliance",{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":4,"name":4,"fn":5,"description":6,"org":5071,"tags":5072,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5073,5074,5075,5076],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":5078,"name":5078,"fn":5079,"description":5080,"org":5081,"tags":5082,"stars":25,"repoUrl":26,"updatedAt":5089},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5083,5084,5087,5088],{"name":20,"slug":21,"type":15},{"name":5085,"slug":5086,"type":15},"Data Analysis","data-analysis",{"name":23,"slug":24,"type":15},{"name":5040,"slug":5041,"type":15},"2026-07-12T07:57:16.190081",{"slug":5091,"name":5091,"fn":5092,"description":5093,"org":5094,"tags":5095,"stars":25,"repoUrl":26,"updatedAt":5102},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5096,5097,5100,5101],{"name":23,"slug":24,"type":15},{"name":5098,"slug":5099,"type":15},"Engineering","engineering",{"name":5040,"slug":5041,"type":15},{"name":5055,"slug":517,"type":15},"2026-07-12T07:57:26.543278",{"slug":5104,"name":5104,"fn":5105,"description":5106,"org":5107,"tags":5108,"stars":25,"repoUrl":26,"updatedAt":5112},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5109,5110,5111],{"name":23,"slug":24,"type":15},{"name":5040,"slug":5041,"type":15},{"name":5055,"slug":517,"type":15},"2026-07-25T05:31:22.562808",34,{"items":5115,"total":5234},[5116,5133,5146,5161,5172,5182,5193,5199,5206,5213,5220,5227],{"slug":5117,"name":5117,"fn":5118,"description":5119,"org":5120,"tags":5121,"stars":5130,"repoUrl":5131,"updatedAt":5132},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5122,5123,5126,5129],{"name":23,"slug":24,"type":15},{"name":5124,"slug":5125,"type":15},"Incident Response","incident-response",{"name":5127,"slug":5128,"type":15},"Kubernetes","kubernetes",{"name":5037,"slug":5038,"type":15},105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":5134,"name":5134,"fn":5135,"description":5136,"org":5137,"tags":5138,"stars":5130,"repoUrl":5131,"updatedAt":5145},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5139,5142,5144],{"name":5140,"slug":5141,"type":15},"Deployment","deployment",{"name":530,"slug":5143,"type":15},"encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":5147,"name":5147,"fn":5148,"description":5149,"org":5150,"tags":5151,"stars":5130,"repoUrl":5131,"updatedAt":5160},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5152,5153,5156,5157],{"name":23,"slug":24,"type":15},{"name":5154,"slug":5155,"type":15},"Debugging","debugging",{"name":5127,"slug":5128,"type":15},{"name":5158,"slug":5159,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":5162,"name":5162,"fn":5163,"description":5164,"org":5165,"tags":5166,"stars":5130,"repoUrl":5131,"updatedAt":5171},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5167,5168,5169,5170],{"name":23,"slug":24,"type":15},{"name":5154,"slug":5155,"type":15},{"name":5140,"slug":5141,"type":15},{"name":5127,"slug":5128,"type":15},"2026-07-12T07:57:24.018818",{"slug":5173,"name":5173,"fn":5174,"description":5175,"org":5176,"tags":5177,"stars":5130,"repoUrl":5131,"updatedAt":5181},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5178,5179,5180],{"name":23,"slug":24,"type":15},{"name":5140,"slug":5141,"type":15},{"name":5127,"slug":5128,"type":15},"2026-07-12T07:56:45.777567",{"slug":5183,"name":5183,"fn":5184,"description":5185,"org":5186,"tags":5187,"stars":5130,"repoUrl":5131,"updatedAt":5192},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5188,5189,5190,5191],{"name":23,"slug":24,"type":15},{"name":5140,"slug":5141,"type":15},{"name":5127,"slug":5128,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:56:47.082609",{"slug":5030,"name":5030,"fn":5031,"description":5032,"org":5194,"tags":5195,"stars":25,"repoUrl":26,"updatedAt":5042},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5196,5197,5198],{"name":23,"slug":24,"type":15},{"name":5037,"slug":5038,"type":15},{"name":5040,"slug":5041,"type":15},{"slug":5044,"name":5044,"fn":5045,"description":5046,"org":5200,"tags":5201,"stars":25,"repoUrl":26,"updatedAt":5056},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5202,5203,5204,5205],{"name":5050,"slug":5051,"type":15},{"name":23,"slug":24,"type":15},{"name":5040,"slug":5041,"type":15},{"name":5055,"slug":517,"type":15},{"slug":5058,"name":5058,"fn":5059,"description":5060,"org":5207,"tags":5208,"stars":25,"repoUrl":26,"updatedAt":5069},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5209,5210,5211,5212],{"name":20,"slug":21,"type":15},{"name":5065,"slug":5066,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":5214,"tags":5215,"stars":25,"repoUrl":26,"updatedAt":27},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5216,5217,5218,5219],{"name":20,"slug":21,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":5078,"name":5078,"fn":5079,"description":5080,"org":5221,"tags":5222,"stars":25,"repoUrl":26,"updatedAt":5089},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5223,5224,5225,5226],{"name":20,"slug":21,"type":15},{"name":5085,"slug":5086,"type":15},{"name":23,"slug":24,"type":15},{"name":5040,"slug":5041,"type":15},{"slug":5091,"name":5091,"fn":5092,"description":5093,"org":5228,"tags":5229,"stars":25,"repoUrl":26,"updatedAt":5102},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5230,5231,5232,5233],{"name":23,"slug":24,"type":15},{"name":5098,"slug":5099,"type":15},{"name":5040,"slug":5041,"type":15},{"name":5055,"slug":517,"type":15},40]