Description

Ensure each Public Cloud Database service has as few administrator-level users as possible, and that applications use separate users with only the permissions they need.

Rationale

Admin users can read, change, or delete all data and settings in the database. Each extra admin account is another credential that could be leaked or misused. Using least-privilege users for applications limits the damage if one of their passwords is exposed.

Impact

  • Limits the impact of a leaked database password

  • Applications get only the access they need

  • Applications may need new users

Default Value

When a service is created, one admin user (avnadmin on many engines) is created.

Pre-Requisites

  • Permission to manage the database service

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Open the Users tab and review each user and its roles.

  5. If several users have admin rights without a documented need, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. In the Users tab, click + Add user, enter a username, select only the roles the application needs, and click Create User.

  5. Update the applications to use the new users.

  6. Delete unnecessary admin users from the ⋯ button in the users table.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, select Databases (under Databases & Analytics), then click the database service to open it.

  4. Re-create the removed user in the Users tab, regenerate its password from the ⋯ button, and update the applications.

Reference