Security

Frequently Asked Questions about Security

What access controls are in place and how can they be audited?

• All Terraform scripts used to deploy e6data can be found in the e6data documentation: Creating Workspaces in AWS

• The AWS Access Policies created by Terraform can be found here:

  • Workspace Creation Permissions

  • View the policies on GitHub

• All permissions are created using the IAM OIDC method for the particular Kubernetes service account in the isolated e6data Kubernetes namespace in the EKS cluster.

Summary of Required Permissions

• The e6data query engine cluster requires read-only access to the data to be queried (S3 buckets) and metastore/catalogs.

  • During workspace deployment, customers are asked to specify which S3 buckets should be accessible the to query engine (i.e bucket level and prefix level) depending on the use cases required.

  • These specific lines in the Terraform script define S3 access: https://github.com/e6x-labs/terraform/blob/main/aws/e6data_engine_iam.tf#L19-L50

• A new S3 bucket for e6data use is created with read-write access in the customer account. It is used to store the following:

  • Schema metadata (table names, column names, number of rows, file paths) for increased performance.

  • If the Query Editor is used, Sheets (SQL query text) are stored.

• Read only access to AWS Glue is required for the engine to know the up-to-date paths to data for efficient query planning compute use.

How are e6data personnel restricted from accessing customers' data? How can this be audited?

Limited Access to e6data Control Plane

• e6data employees do not have access to the e6data production system (e6data Control Plane).

• e6data employees can only monitor & debug the Control Plane using Grafana.

• e6data employees can only perform deployments via a CI/CD pipeline secured with multi-factor authentication.

No Access to Data Plane

• e6data employees have no way of accessing the Data Plane in the customer’s environment.

• All communication between the Control Plane & Data Plane takes place between applications.

• Multiple levels of logging are in place to audit inter-planar communication:

  • Kubernetes logging

    • It is recommended to enable the Audit and Authenticator logging features in your EKS cluster which helps monitor the operations performed by the e6data Kubernetes user and any IAM authentications for Kubernetes entry points that take place.

    • Guide to enabling Kubernetes logging

  • S3 access logging

    • The S3 bucket created during deployment for the e6data query engine's usage will have access logs enabled by default.

    • This helps to track the access usage by e6data Control Plane applications on the mentioned S3 bucket.

    • Guide to enabling S3 access logging

  • Any API call that can cause the query engine to resume, suspend or scale needs to pass through the IAM layer to make an STS call on the Assume Role. This can be logged by the customer using Cloudtrail to detect any suspicious events.

    • Guide to integrating Cloudtrail

  • EKS Authorized Networks

    • The IP range of e6data Control Plane can be allow listed for EKS access in addition to the IAM and Kubernetes RBAC access controls as an added layer of security

      • Guide to using Authorized Networks for EKS

What data moves outside the customer's data plane?

What data is stored in the Control Plane?

The only data that moves from the Data Plane to the Control Plane and are stored by e6data are:

• Usage, logs, and infrastructure metrics

  • Cluster infrastructure metrics

  • Number of pods and how long pods of each component (planners, queue managers, executors) are running

  • How many nodes are active

  • How long nodes are active for

  • CPU, memory, network, and I/O utilization of each pod

• Cluster query metrics

  • Count of count successful, failed & running queries.

  • Masked query (SQL) text

    • Any part that may contain sensitive information is masked prior to movement to the control plane (filter by, group by, where clauses)

  • Hash of queries that are run.

  • The run duration of each query.

  • User who ran the query.

• Schema information

  • Schemas (table and column names) for Schema Explorer in Query Editor

What data other data moves outside the Data Plane?

• If the Query Editor is used, query results will be streamed to the user's browser via the Control Plane.

• However, Query results are only visible in UI. Data remains in your data plane – e6data doesn’t upload, access, or download it.

• If you use the Query Editor your query is created on the front end of e6data’s web UI in your browser, behind your firewalls and VPN, and is not accessed by any e6data employees.

• When writing interactive queries using the Query Editor, for example: select * from users limit 1000 the data from your customers table will pass through the e6data infrastructure on the way to your browser. Data is not retained on e6data servers. Data does not live on e6data servers outside of your session. e6data employees are not able to access those sessions. Data is not written to disk.