> ## Documentation Index
> Fetch the complete documentation index at: https://cockroachlabs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# CockroachDB Cloud Security Overview
export const InternalLink = ({version, path = "", children, ...props}) => {
let detectedVersion = version || "stable";
if (typeof window !== 'undefined' && !version) {
const match = window.location.pathname.match(/\/docs\/([^/]+)/);
if (match) {
detectedVersion = match[1];
}
}
const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
return
{children}
;
};
This page summarizes the security features available in CockroachDB Cloud:
* CockroachDB Standard: Deployed in shared (multi-tenant) network and compute infrastructure. Storage scales automatically according to demand, but the cluster's compute requirements are defined explicitly as part of the cluster's configuration.
* CockroachDB Basic: Deployed in shared (multi-tenant) network and compute infrastructure. Storage and compute scale automatically according to demand, and you are charged only for the storage and activity of your cluster.
* CockroachDB Advanced: Deployed in dedicated network and compute infrastructure. This deployment may be distributed over multiple regions for added disaster-resilience. In addition to infrastructure isolation, Advanced clusters can be customized with advanced network, identity-management, and encryption-related security features required for high benchmark security goals such as PCI DSS compliance. Refer to Payment Card Industry Data Security Standard (PCI DSS) Compliance in CockroachDB Advanced
The following table summarizes the CockroachDB Cloud security features and provides links to detailed documentation for each feature where applicable.
| Security Domain | CockroachDB Basic | CockroachDB Standard | CockroachDB Advanced | Feature |
| -------------------------------------------------------------------------------------------------------- | ----------------- | -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication | ✓ | ✓ | ✓ | Inter-node and node identity authentication using TLS 1.3 |
| ✓ | ✓ | ✓ | Client identity authentication using a username and password | |
| ✓ | ✓ | ✓ | SASL/SCRAM-SHA-256 secure password-based authentication | |
| | | ✓ | Cluster DB console authentication with third-party Single Sign On (SSO) using [OpenID Connect OIDC](https://openid.net/connect) or [SAML](https://wikipedia.org/wiki/Security_Assertion_Markup_Language) | |
| ✓ | ✓ | ✓ | SQL Client authentication with Cluster SSO using CockroachDB Cloud as identity provider | |
| ✓ | ✓ | ✓ | SQL Client authentication with Cluster SSO using customer-managed identity providers | |
| | | ✓ | Client identity authentication using PKI certificates | |
| | | ✓ | OCSP certificate revocation protocol | |
| Data Protection | ✓ | ✓ | ✓ | Encryption-in-flight using TLS 1.3 |
| ✓ | ✓ | ✓ | Automatic backups for AWS clusters are encrypted-at-rest using [AWS S3’s server-side encryption](https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption) | |
| ✓ | ✓ | ✓ | Automatic backups for GCP clusters are encrypted-at-rest using [Google-managed server-side encryption keys](https://cloud.google.com/storage/docs/encryption/default-keys) | |
| ✓ | ✓ | ✓ | Industry-standard encryption-at-rest provided at the infrastructure level by your chosen deployment environment, such as Google Cloud Platform (GCP), Amazon Web Services (AWS), or Microsoft Azure. | |
| | | ✓ | Customer Managed Encryption Keys (CMEK), with Advanced security features enabled. | |
| Access Control (Authorization) | ✓ | ✓ | ✓ | SQL users with direct privilege management |
| ✓ | ✓ | ✓ | SQL Role-based access control (RBAC) | |
| ✓ | ✓ | ✓ | Cloud Organization users with fine-grained access roles | |
| Network Security | ✓ | ✓ | ✓ | SQL-level configuration of allowed authentication attempts by IP address |
| | | ✓ | Private Clusters | |
| ✓ | ✓ | ✓ | Network-level Configuration of allowed IP addresses | |
| | | ✓ | Egress Perimeter Controls | |
| | ✓ | ✓ | Private Service Connect (PSC) for GCP clusters | |
| | | ✓ | VPC Peering for GCP clusters | |
| | ✓ | ✓ | PrivateLink for AWS clusters. | |
| | | ✓ | Egress private endpoints | |
| [Non-Repudiation](https://wikipedia.org/wiki/Non-repudiation) | ✓ | ✓ | ✓ | SQL Audit Logging |
| ✓ | ✓ | ✓ | Cloud Organization Audit Logging | |
| Availability/Resilience | ✓ | ✓ | ✓ | CockroachDB, as a distributed SQL database, is uniquely resilient by nature. A cluster can tolerate node failures as long as the majority of nodes remain functional. See Disaster Recovery. |