{"id":4101,"date":"2024-09-18T15:25:43","date_gmt":"2024-09-18T22:25:43","guid":{"rendered":"https:\/\/www.couchbase.com\/blog\/data-security-capella-columnar-rbac\/"},"modified":"2024-09-18T15:25:43","modified_gmt":"2024-09-18T22:25:43","slug":"data-security-capella-columnar-rbac","status":"publish","type":"post","link":"https:\/\/www.couchbase.com\/blog\/es\/data-security-capella-columnar-rbac\/","title":{"rendered":"Capella Columnar RBAC: Ensuring Data Security and Controlled Access"},"content":{"rendered":"

Controlling who can do what in your application is crucial, and in many cases not everyone should have the same permissions or capabilities in the application, as this can lead to security risks and operational inefficiencies.<\/span><\/p>\n\n\n\n

In this blog, we show a couple of techniques for restricting access to application functionality based on the user using the app.\u00a0\u00a0<\/span><\/p>\n\n\n\n

There are two primary types of restrictions in Capella Columnar:<\/span><\/p>\n\n\n\n

Restricting Access to the Columnar UI<\/span><\/a>: Access to the user interface (UI) is controlled by assigning specific roles to users. This ensures that only authorized personnel can interact with the UI.<\/span><\/p>\n\n\n\n

Defined Roles and Access for External Tools:<\/span><\/a> In addition to UI access, Capella Columnar allows for the definition of roles and access permissions for various external tools, such as BI tools and REST APIs. This fine-grained control helps secure your data and ensures that each user has the necessary permissions to perform their tasks without overstepping boundaries.<\/span><\/p>\n\n\n\n

Let us understand the Columnar RBAC with an example. <\/span>Penny<\/b>, the startup founder of <\/span>ClientEase<\/span><\/i> is a <\/span>Capella Columnar<\/a> customer.\u00a0<\/span><\/p>\n\n\n\n

ClientEase acts as an intermediary between companies and their customers, handling support and inquiries using data provided by the parent company. They provide efficient assistance in training and development services as well.<\/span><\/i><\/p>\n\n\n\n

One of the projects in ClientEase is <\/span>Retail Chain Management.<\/span><\/i> Penny has an <\/span>Organization Owner<\/b> role in Capella.<\/span><\/p>\n\n\n\n

Penny being the startup founder has many other responsibilities. She gave <\/span>Rob<\/b>, who is a manager, responsibility for this project and made him the<\/span> Project Owner<\/b>.\u00a0<\/span><\/p>\n\n\n\n

\"\"<\/p>\n\n\n\n

Rob took full responsibility for the project and divided it in a structured way. He created two clusters in Columnar named <\/span>Retail Sales Analysis <\/span><\/i>and <\/span>Product Performance.<\/span><\/i><\/p>\n\n\n\n

\"\"<\/p>\n\n\n\n

He appointed Jack and Kim. <\/span>Jack<\/b> is assigned a Columnar role <\/span>Database Reader\/Writer. <\/b>Rob wanted Kim to look after cluster management and monitoring but did not want Kim to have access to the data and was assigned <\/span>Project Manager<\/b>.\u00a0<\/span><\/p>\n\n\n\n

Jack did a great job and created databases and scopes and collections in both the cluster according to the use case. He created links and ingested data from <\/span>AWS S3<\/span><\/i> to the columnar clusters. He created the following structure of the project which made Rob really happy.<\/span><\/p>\n\n\n\n

\"\"<\/p>\n\n\n\n

ClientEase<\/span><\/i> uses <\/span>Power BI<\/span><\/i> for support analysis. Rosa and Denis manage customer support for this project. Rob wants to keep things clean and distinguished. <\/span><\/p>\n\n\n\n

Rob has created access accounts for Rosa and Denis and assigned them appropriate roles and privileges, allowing Rosa to read from both clusters and Denis to create Tabular Views.<\/span><\/p>\n\n\n\n

\"\"<\/p>\n\n\n\n

\"\"<\/p>\n\n\n\n

The following tables shows users and their roles\/privileges:<\/span><\/p>\n\n\n\n

\n\n\n\n\n\n\n\n\n
User<\/b><\/td>\nCapella Columnar Role\/privilege<\/b><\/td>\n<\/tr>\n
Penny<\/span><\/td>\nOrganization Owner<\/span><\/td>\n<\/tr>\n
Rob<\/span><\/td>\nProject Owner<\/span><\/td>\n<\/tr>\n
Kim<\/span><\/td>\nProject Manager<\/span><\/td>\n<\/tr>\n
Jack<\/span><\/td>\nDatabase Data Reader\/Write<\/span><\/td>\n<\/tr>\n
Rosa<\/span><\/td>\nsys_data_reader for <\/span>Retail Sales<\/span> Analysis and\u00a0 <\/span>Product Performance.<\/span><\/i><\/td>\n<\/tr>\n
Denis<\/span><\/td>\nCreate View, Select Collection globally for <\/span>Retail Sales<\/span> Analysis and\u00a0 <\/span>Product Performance.<\/span><\/i><\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n

Everything was going smoothly with this:<\/span><\/p>\n\n\n\n