Cloud environment analytics using snapshotting
The technology disclosed relates to streamlined analysis of security posture of a cloud environment. In particular, the disclosed technology relates to a system that analyzes data posture in a cloud environment database using a snapshot of the database. A computer-implemented method includes receiving a request to access a database in the cloud environment, wherein the database includes a first authentication requirement. The method includes identifying a snapshot of the database, wherein the snapshot includes a second authentication requirement that is different than the first authentication requirement. The method includes accessing the snapshot using the second authentication requirement, generating a representation of the database using the snapshot, and generating a data posture analysis result indicative of a data posture of the database based on scanning the representation of the database.
1. A computer-implemented method for analyzing data posture in a cloud environment, the method comprising:
receiving a request to access a database in the cloud environment, wherein the database includes a first authentication requirement;
identifying a snapshot of the database, wherein the snapshot includes a second authentication requirement that is different than the first authentication requirement;
accessing the snapshot using the second authentication requirement;
generating a representation of the database using the snapshot;
receiving a request to perform data posture analysis of the database;
scanning the representation of the database to obtain metadata representing a structure of schema objects in the database;
based on the metadata, executing a content-based data classifier that analyzes content of data items in the schema objects by comparing the data items to predefined target data profiles and generates a classifier result that classifies the data items based on the content; and
generating a representation of a user interface display that represents the data posture analysis of the database and renders the classifier result.
2. The computer-implemented method of claim 1 , wherein the first authentication requirement comprises a user access credential, and the second authentication requirement comprises a cloud environment role.
3. The computer-implemented method of claim 2 , wherein the user access credential comprises secret data corresponding to a user associated with the database, and wherein the cloud environment role comprises a cloud provider role.
4. The computer-implemented method of claim 2 , wherein the database comprises a first database having a first user access credential, and wherein the snapshot comprises a first snapshot, and further comprising:
receiving a request to access a second database in the cloud environment, wherein the second database includes a second user access credential that is different than the first user access credential; and
identifying a second snapshot of the second database, wherein the second snapshot includes a same authentication requirement as the first snapshot.
5. The computer-implemented method of claim 4 , and further comprising:
discovering the first and second snapshots using a cloud provider application programming interface (API); and
accessing each of the first and second snapshots through the cloud provider API.
6. The computer-implemented method of claim 1 , wherein scanning the representation of the database comprises:
tracing network communication paths between pairs of compute resources and storage resources;
qualifying a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack; and
generating a representation of propagation of the breach attack along the network communication paths, the representation of propagation of the breach attack identifying relationships between the subset of the pairs of the compute resources and the storage resources.
7. The computer-implemented method of claim 1 , wherein
the database is stored on a first server in the cloud environment,
generating the representation of the database comprises recreating the database on a second server using the snapshot, and
scanning the representation of the database comprises scanning the recreated database on the second server.
8. The computer-implemented method of claim 1 , wherein the snapshot comprises a read-only point-in-time copy of the database, and the database is deployed in a production environment and configured to receive a user request for a data manipulation operation on data stored in the database.
9. The computer-implemented method of claim 1 , wherein the schema objects comprise a data column within a table, and the data items comprise a plurality of cells within the data column.
10. A computing system comprising:
at least one processor; and
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
receive a request to access a database in a cloud environment, wherein the database includes a user-based authentication credential;
identify a point-in-time copy of the database that includes a role-based authentication credential;
access the point-in-time copy using the role-based authentication credential;
generate a representation of the database using the point-in-time copy;
receive a request to perform data posture analysis of the database;
scan the representation of the database to obtain metadata representing a structure of schema objects in the database;
based on the metadata, execute a content-based data classifier that analyzes content of data items in the schema objects by comparing the data items to predefined target data profiles and generates a classifier result that classifies the data items based on the content; and
generate a representation of a user interface display that represents the data posture analysis and renders the classifier result.
11. The computing system of claim 10 , wherein the user-based authentication credential comprises a user access credential, and the role-based authentication credential comprises a cloud provider role.
12. The computing system of claim 11 , wherein the user access credential comprises secret data corresponding to a user associated with the database.
13. The computing system of claim 11 , wherein the database comprises a first database having a first user access credential, and wherein the point-in-time copy comprises a first point-in-time copy, and wherein the instructions, when executed, cause the computing system to:
receive a request to access a second database in the cloud environment, wherein the second database includes a second user access credential that is different than the first user access credential; and
identify a second point-in-time copy of the second database, wherein the second point-in-time copy includes a same authentication requirement as the first point-in-time copy.
14. The computing system of claim 13 , wherein the instructions, when executed, cause the computing system to:
discover the first and second point-in-time copies using a cloud provider application programing interface (API); and
access each of the first and second point-in-time copies through the cloud provider API using the same authentication requirement.
15. The computing system of claim 10 , wherein the database is deployed in a production environment and configured to receive a user request for a data manipulation operation on data stored in the database.
16. A computing system comprising:
at least one processor; and
memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:
receive one or more requests to access a plurality of databases in the cloud environment, wherein the plurality of databases includes different sets of authentication requirements;
identify a plurality of snapshots that correspond to the plurality of databases, wherein each snapshot, of the plurality of snapshots, includes an authentication requirement that is different than an authentication requirement of the database that corresponds to the snapshot;
access each snapshot of the plurality of snapshots using a cloud provider role defined in the cloud environment;
generate a set of representations of the plurality of databases using the plurality of snapshots;
receive a request to perform data posture analysis of the plurality of databases;
scan the set of representations of the plurality of databases to obtain metadata representing a structure of schema objects in the plurality of databases;
based on the metadata, execute a content-based data classifier that analyzes content of data items in the schema objects by comparing the data items to predefined target data profiles and generates a classifier result that classifies the data items based on the content; and
generate a representation of a user interface display that represents the data posture analysis sand renders the classifier result.
17. The computing system of claim 16 , wherein
a first database of the plurality of databases has a first user access credential, and
a second database of the plurality of databases has a second user access credential.
18. The computing system of claim 16 , wherein each particular snapshot of the plurality of snapshots comprises a read-only point-in-time copy of a respective database corresponding to the particular snapshot.
19. The computing system of claim 18 , wherein
the instructions, when executed, cause the computing system to:
recreate each respective database, of the plurality of databases, in a cloud environment server using the snapshot corresponding to the respective database, and
scan the recreated databases to identify the data posture.
20. The computing system of claim 16 , wherein the instructions, when executed, cause the computing system to:
trace network communication paths between pairs of compute resources and storage resources;
qualify a subset of the pairs of the compute resources and the storage resources as vulnerable to breach attack; and
generate a representation of propagation of the breach attack along the network communication paths, the representation of propagation of the breach attack identifying relationships between the subset of the pairs of the compute resources and the storage resources.