skills.rest
chmonitor
chmonitorOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-hardening

Configure RBAC, row policies, quotas, and audit logs for ClickHouse clusters.

255|42|Updated Nov 16, 2023
Search Tags:#security#access control#rbac#audit logging#clickhouse#row policies#database hardening
One-click install
npx skills add https://github.com/chmonitor/chmonitor --skill security-hardening-chmonitor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hardening
Source: https://github.com/chmonitor/chmonitor/tree/main/.agents/skills/security-hardening
Command: npx skills add https://github.com/chmonitor/chmonitor --skill security-hardening-chmonitor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Unsecured self-hosted ClickHouse deployments risk unauthorized data access, compliance violations, and resource abuse from unregulated query usage. This Skill provides clear, actionable guidance to implement robust security controls for ClickHouse instances.

Core Features & Use Cases

  • RBAC Configuration: Set up granular role-based access control to restrict user permissions to only the data and operations they need.
  • Row-Level Security: Implement row policies to enforce multi-tenant data isolation, ensuring users can only access rows assigned to their tenant.
  • Resource Quotas & Audit Logging: Enforce query and resource usage limits for non-admin users, and enable audit logs to track all data access for compliance reporting.
  • Use Case: A platform engineer managing a ClickHouse cluster for multiple internal teams can use this Skill to set up role-based access so analysts only query their assigned datasets, enforce per-user query limits to prevent downtime from runaway queries, and enable audit logs to track all data access for SOC 2 compliance.

Quick Start

Use the security-hardening skill to configure RBAC roles, row policies, and audit logging for my self-hosted ClickHouse cluster to meet compliance requirements.

Frequently Asked Questions about security-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up RBAC and row policies in ClickHouse for multi-tenant data isolation?▼

ClickHouse RBAC and row policies enforce multi-tenant data isolation by restricting user access to assigned rows. You configure granular roles and apply row policies to ensure users only query their specific tenant datasets.

What's the best way to secure a self-hosted ClickHouse deployment against unauthorized access?▼

Securing a self-hosted ClickHouse deployment involves configuring network security, enforcing resource quotas, and enabling audit logging. This structured hardening approach eliminates unauthorized access risks and ensures compliance for production clusters.

How can I enable audit logging in ClickHouse for SOC 2 compliance reporting?▼

ClickHouse audit logging tracks all data access for SOC 2 compliance reporting. You enable audit logs to record query execution and data access events across the cluster, satisfying compliance requirements for non-admin users.

Does this security hardening guidance apply to production ClickHouse clusters managed by platform engineers?▼

Yes, this security hardening guidance targets database administrators and platform engineers managing production ClickHouse clusters. It applies specifically to self-hosted deployments requiring structured access controls, resource limits, and audit trails.

How do I enforce query and resource usage limits for non-admin ClickHouse users?▼

You enforce query and resource usage limits for non-admin ClickHouse users by configuring resource quotas. This prevents cluster downtime from runaway queries and restricts unregulated query usage across internal teams.

Related Skills

Explore More Software Engineering Skills→
rohitg00rohitg00
944

k8s-security

Audit Kubernetes RBAC configurations and enforce security policies across clusters.

Community
Basic
Greenmamba29Greenmamba29

audit-log-monitor

Monitor security audit logs and generate real-time alerts for unauthorized access.

Community
Advanced
EngineerWithAIEngineerWithAI
4

k8s-security-policies

Implement Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC security policies.

Official
Advanced
MapleTechLabsMapleTechLabs
1.6k

clickhousectl-cloud-deploy

Automate ClickHouse deployment to managed ClickHouse Cloud services.

Official
Intermediate