Create enforcement.md - Encryption Enforcement topic #403
Conversation
populated with encryption enforcement
updated with future steps to enforce encrypt
…postgres into docs-create-enforcement
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## release-17.5.2 #403 +/- ##
=================================================
Coverage ? 84.67%
=================================================
Files ? 21
Lines ? 2590
Branches ? 401
=================================================
Hits ? 2193
Misses ? 316
Partials ? 81
🚀 New features to boost your workflow:
|
updated with pg_tde enforce encryption option
…postgres into docs-create-enforcement
removed table space encryption
updated the enforce_encryption description
added a note that clarifies unauthorized user access and how superusers can still bypass the forced encryption table creation
There was a problem hiding this comment.
Now my generic problem with this PR is that this new page doesn't provide any additional information compared to the GUC page. In fact, it provides less, as the GUC page at least explains to an extent what are the different allowed scopes of the variable.
Jan asked for scenarios to be documented, I guess he meant things like:
- Specific example how to enforce encryption to the entire server
- Specific example how to enforce encryption to only a single database with
ALTER DATABASE SET - Example that superusers can override the variable at session level, so that they can create non encrypted tables in that session (the usecase I described on slack)
- Maybe also an example of enforcing encryption to a specific user with
ALTER USER
Which is basically adding actual examples to the "Use the following techniques..." section
small update to the note describing superuser actions properly
Added a couple of simple examples to encryption enforcement for user, database and global enforcement using enforce_encryption Added What does enforcement do (for new users) Added that you can override enforcement with details possible by superusers only Updated variables with minor linting and added a link to encryption enforcement for pg_tde.enforce_encryption
|
Added a couple of simple examples to encryption enforcement for user, database and global enforcement using enforce_encryption Added What does enforcement do (for new users) Added that you can override enforcement with details possible by superusers only Updated variables with minor linting and added a link to encryption enforcement for pg_tde.enforce_encryption |
Writing a general topic regarding Encrpytion Enforcement from pg_tde perspective, requires heavy review.