Update to CockroachDB

{
  "description": "Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",
  "included_files": [
    {
      "relative_path": "references/ccloud-commands.md",
      "size_in_bytes": 4420
    },
    {
      "relative_path": "references/permissions.md",
      "size_in_bytes": 3895
    },
    {
      "relative_path": "references/sample-report.md",
      "size_in_bytes": 9106
    },
    {
      "relative_path": "references/sql-queries.md",
      "size_in_bytes": 4849
    }
  ],
  "name": "audit-cloud-security",
  "skill_md_contents": "---\nname: audit-cloud-security\ndescription: Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.\ncompatibility: Requires ccloud CLI authenticated via `ccloud auth login` and SQL access via cockroach sql with admin or VIEWACTIVITY privilege.\n---\n\n# Auditing Cloud Cluster Security\n\nAssesses the security posture of a CockroachDB Cloud cluster by examining network access controls, authentication and SSO configuration, user authorization, encryption, audit logging, and backup status. Produces a structured PASS/WARN/FAIL report with remediation links for each finding. Supports both CockroachDB Cloud and self-hosted clusters — checks that don't apply to the deployment model are marked N/A.\n\n**Read-only audit:** All operations are read-only. No cluster state is modified during the assessment.\n\n## When to Use This Skill\n\n- Preparing for SOC 2, HIPAA, or other compliance reviews\n- Conducting periodic security posture assessments\n- Onboarding a new production cluster and validating security baseline\n- Investigating security configuration gaps after an incident\n- Reviewing cluster security before a major release or customer onboarding\n\n## Prerequisites\n\n**Tools:**\n\n| Tool | Cloud | Self-Hosted | Purpose |\n|------|-------|-------------|---------|\n| `ccloud` CLI | Required | N/A | Cluster metadata, network config, CMEK |\n| `cockroach sql` | Required | Required | SQL security checks |\n| `openssl` (v3+) | Recommended | Recommended | TLS/PQC cipher probing (`-starttls postgres`) |\n| `sslyze` | Optional | Optional | Comprehensive TLS enumeration (`--starttls postgres`) |\n\n**Credentials:**\n\n| Credential | Cloud | Self-Hosted |\n|---|---|---|\n| `ccloud auth login` session | Required | N/A |\n| SQL connection string | Required (from `ccloud cluster sql --url`) | Required (user provides) |\n| DB username/password | Required (admin or VIEWACTIVITY) | Required (admin or VIEWACTIVITY) |\n| TLS certificates directory | N/A (managed) | Required for cert expiry checks |\n| CA certificate file | N/A | Required for `openssl` TLS probing |\n\nSee [permissions reference](references/permissions.md) for detailed privilege requirements.\n\n## Security Audit Dimensions\n\n| Dimension | Tool | Checks |\n|-----------|------|--------|\n| Network Security | ccloud | IP allowlists, private endpoints |\n| Authentication & SSO | ccloud + sql | Cloud Console SSO, Database SSO (Cluster SSO), SCIM 2.0 provisioning, auto user provisioning |\n| Authorization | sql | Users, roles, admin grants, PUBLIC privileges |\n| Encryption | ccloud + sql | CMEK status, TLS settings |\n| Audit Logging | sql | Audit log config, session logging |\n| Backup & Recovery | ccloud + sql | Managed backup status, self-managed backup schedules |\n| Cryptographic Posture | sql + openssl + sslyze | TLS version, PQC hybrid cipher support, encryption key size |\n| Cluster Context | ccloud + user input | Deployment model, environment, compliance, data sensitivity |\n| Cluster Configuration | ccloud | Version, plan, regions |\n\n## Assessment Workflow\n\n### Step 0: Verify Prerequisites\n\nRun the following checks to determine which tools are available. The audit proceeds regardless — missing tools degrade specific checks rather than blocking the audit.\n\n**Cloud clusters:**\n```bash\n# Verify ccloud authentication\nccloud auth whoami\n\n# Verify cluster access\nccloud cluster list -o json\n```\n\n**Both deployment models:**\n```bash\n# Verify SQL connectivity\ncockroach sql --url \"<connection-string>\" -e \"SELECT current_user();\"\n\n# Check openssl version (v3+ recommended for PQC probes)\nopenssl version\n\n# Check sslyze availability\nwhich sslyze && sslyze --version\n```\n\n**Report tool availability before proceeding:**\n\n| Tool | Status | Impact if Missing |\n|------|--------|-------------------|\n| `ccloud` | Available / Missing | Network, CMEK, and managed backup checks skipped (Cloud only) |\n| `cockroach sql` | Available / Missing | **All SQL-based checks skipped** — audit severely limited |\n| `openssl` (v3+) | Available / Missing | TLS cipher and PQC probing degraded |\n| `sslyze` | Available / Missing | Comprehensive TLS enumeration unavailable; falls back to `openssl` |\n\nIf `cockroach sql` is unavailable, warn the user that the audit will be limited to `ccloud`-only checks and recommend resolving connectivity before continuing. For missing optional tools (`openssl`, `sslyze`), note which checks will produce incomplete results and proceed.\n\n### Step 1: Gather Cluster Metadata and Confirm Audit Context\n\n**Cloud clusters:**\n```bash\n# List clusters and identify target\nccloud cluster list -o json\n\n# Get cluster details (use cluster name or ID)\nccloud cluster info <cluster-name> -o json\n```\n\n**Self-hosted clusters:**\n```bash\n# Gather metadata via SQL and cockroach CLI\ncockroach node status --certs-dir=<certs-dir> --host=<host>\ncockroach sql --url \"<connection-string>\" -e \"SELECT version();\"\n```\n\nRecord: cluster ID, plan type (Basic/Standard/Advanced or self-hosted), cloud provider, regions, CockroachDB version. See [ccloud commands reference](references/ccloud-commands.md) for Cloud CLI syntax.\n\n**Confirm audit context:** Present auto-detected metadata (cluster name, version, provider, regions, plan) and ask the user to confirm and provide:\n\n1. **Deployment model:** CockroachDB Cloud / self-hosted\n2. **Environment:** production / staging / development / sandbox\n3. **Compliance frameworks:** SOC 2, HIPAA, PCI DSS, ISO 27001, GDPR, or none\n4. **Data sensitivity:** PII/PHI, financial/payment, internal business, public/non-sensitive\n\n**Defaults** (if user confirms without changes): Cloud, production, no compliance, internal business data. Deployment model determines check applicability (below). Environment and compliance calibrate severity (see Severity Adjustments).\n\n### Check Applicability by Deployment Model\n\n| Check | Cloud | Self-Hosted |\n|-------|-------|-------------|\n| IP allowlists (ccloud) | Yes (all tiers) | N/A — managed externally via firewall/VPC |\n| Ingress Private Endpoints (ccloud) | Yes (Standard+, Advanced) | N/A |\n| Egress Private Endpoints (ccloud) | Yes (Advanced) | N/A |\n| HBA configuration (SQL) | Yes | Yes — primary network-level auth control |\n| Cloud Console SSO | Yes | N/A |\n| SCIM 2.0 | Yes | N/A |\n| Database SSO (OIDC) | Yes | Yes |\n| Database SSO (LDAP/AD) | Yes | Yes |\n| Users & Roles (SQL) | Yes | Yes |\n| Privileges (SQL) | Yes | Yes |\n| CMEK (ccloud) | Yes | N/A — check Enterprise Encryption instead |\n| Enterprise Encryption | N/A | Yes — verify encryption-at-rest via store config |\n| TLS | Always PASS (enforced) | Check — verify certs, expiry, config |\n| TLS 1.3 / PQC / Key Size | Yes (INFO) | Yes (INFO) |\n| Audit Logging (SQL) | Yes | Yes |\n| Managed Backups (ccloud) | Yes (automatic) | N/A |\n| Self-Managed Backups (SQL) | Optional (if managed backups present) | Yes — verify backup schedules exist and are running |\n\nSkip N/A checks for the detected deployment model and mark them as `[N/A]` in the report rather than PASS/FAIL.\n\n### Step 2: Assess Network Security\n\n**Cloud clusters:** Check all three layers based on cluster tier:\n\n```bash\n# IP allowlists (all tiers)\nccloud cluster networking allowlist list <cluster-id> -o json\n\n# Ingress private endpoints (Standard+, Advanced) — via Cloud Console or API\n# Cloud Console: Networking > Private endpoint tab\n# API: GET /api/v1/clusters/{cluster_id}/networking/private-endpoint-connections\n\n# Egress private endpoints (Advanced only) — via Cloud Console or API\n# Cloud Console: Networking > Egress tab\n# API: GET /api/v1/clusters/{cluster_id}/networking/egress-endpoints\n```\n\n```sql\n-- HBA configuration (all tiers)\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n```\n\n**Evaluate (Cloud):**\n- **FAIL** if `0.0.0.0/0` is in the IP allowlist (open to all traffic)\n- **WARN** if allowlist contains broad CIDR ranges (e.g., `/8` or `/16`)\n- **WARN** if no private endpoints configured on Advanced plan\n- **INFO** if private endpoints not available on current tier\n- **PASS** if allowlist contains only specific, narrow CIDR ranges or private endpoints are configured\n\n**Self-hosted clusters:** Check HBA configuration as the primary network-level auth control:\n\n```sql\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n```\n\n**Evaluate (self-hosted):**\n- **WARN** if HBA configuration is empty or default — network security may be managed externally (firewalls, security groups, VPCs), so this is WARN not FAIL\n- **PASS** if HBA rules restrict connections by IP, subnet, or auth method\n\n### Step 3: Check SSO and SCIM Configuration\n\n> For self-hosted clusters, skip Cloud Console SSO and SCIM checks (N/A). Database SSO checks still apply — check OIDC and/or LDAP/AD configuration.\n\n**Cloud Console SSO** (Cloud Console UI > Organization Settings > Authentication — not via ccloud CLI):\n- **FAIL** if SSO is not configured\n- **PASS** if SAML or OIDC SSO is enabled and enforced\n\n**Database SSO (Cluster SSO) — OIDC:**\n```sql\n-- Check if Cluster SSO is enabled for SQL authentication\nSHOW CLUSTER SETTING server.oidc_authentication.enabled;\nSHOW CLUSTER SETTING server.oidc_authentication.provider_url;\n```\n- **FAIL** if `server.oidc_authentication.enabled` is `false`\n- **PASS** if enabled with a valid provider URL\n\n**Database SSO — LDAP/AD (Cloud and self-hosted):**\n```sql\n-- Check if LDAP authentication is configured via HBA\nSHOW CLUSTER SETTING server.host_based_authentication.configuration;\n-- Look for ldap auth method entries in the HBA configuration\n```\n- **PASS** if HBA contains entries with `ldap` auth method\n- **INFO** if LDAP is not configured (OIDC may be used instead)\n\n**SCIM 2.0** (Cloud Console UI > Organization Settings > Authentication > SCIM):\n- **FAIL** if SCIM endpoint is not enabled; **PASS** if enabled and connected to an IdP\n\n**Auto user provisioning on Database:**\n```sql\n-- Check if SQL users are automatically provisioned from SSO identities\nSHOW CLUSTER SETTING server.identity_map.configuration;\n```\n- **FAIL** if identity mapping is not configured\n- **PASS** if identity mapping routes IdP identities to SQL users\n\n### Step 4: Audit Users and Roles\n\n```sql\n-- List all users and their roles\nSELECT\n  username,\n  options,\n  member_of\nFROM [SHOW USERS]\nORDER BY username;\n```\n\nSee [SQL queries reference](references/sql-queries.md) for additional role audit queries.\n\n### Step 5: Check Privileges\n\n```sql\n-- Count admin role members\nSELECT COUNT(*) AS admin_count\nFROM [SHOW GRANTS ON ROLE admin];\n\n-- Check PUBLIC role privileges on the current database\n-- Note: SHOW GRANTS FOR public is scoped to the current database.\n-- Run this query from each application database to get full coverage.\nSELECT\n  database_name,\n  schema_name,\n  object_name,\n  object_type,\n  privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public'\nORDER BY database_name, object_name;\n```\n\n**Important:** `SHOW GRANTS FOR public` is scoped to the current database. Run `SHOW DATABASES;` and repeat the query from each database for full coverage.\n\n**Evaluate:**\n- **FAIL** if more than 5 users have admin role\n- **FAIL** if PUBLIC has SELECT, INSERT, UPDATE, or DELETE on application tables\n- **WARN** if admin count is between 3 and 5\n- **PASS** if admin count is 1-2 and PUBLIC has minimal grants\n\n### Step 6: Verify Encryption\n\n**CMEK status (Cloud clusters):**\n```bash\n# Check CMEK configuration (Advanced plan with Advanced Security Add-on)\nccloud cluster info <cluster-name> -o json\n# Look for cmek_config in the output\n```\n\n**Evaluate by plan type (Cloud):**\n- **Standard plan:** INFO — \"Upgrade to Advanced plan with Advanced Security Add-on to enable CMEK\"\n- **Advanced plan without Advanced Security Add-on:** INFO — \"Add Advanced Security Add-on to enable CMEK\"\n- **Advanced plan with Advanced Security Add-on, CMEK not enabled:** FAIL — CMEK not enabled despite plan supporting it\n- **Advanced plan with Advanced Security Add-on, CMEK enabled:** PASS\n\n**Enterprise Encryption (self-hosted — skip CMEK, check this instead):**\n\nEnterprise Encryption-at-Rest is configured at node start via the\n`--enterprise-encryption` flag and is not exposed as a SQL cluster setting.\nConfirm it by:\n- Inspecting the node's startup arguments (process command line / systemd unit\n  / Kubernetes pod spec) for `--enterprise-encryption=...`\n- Checking the per-node Prometheus endpoint:\n  `curl -ks https://<node>:8080/_status/vars | grep '^rocksdb_encryption_'`\n- The DB Console **Advanced Debug** → **Stores** view reports the active\n  encryption type per store\n\n- **FAIL** if not enabled and cluster stores sensitive data\n- **WARN** if encryption status cannot be determined\n- **PASS** if enabled with AES-256\n\n**TLS (Cloud):** Always PASS — enforced on all connections.\n\n**TLS (self-hosted):** Verify certificate validity and expiry (NOT auto-PASS):\n```bash\ncockroach cert list --certs-dir=<certs-dir>\nopenssl x509 -in <certs-dir>/node.crt -noout -enddate\n```\n- **FAIL** if any certificate expires within 30 days\n- **WARN** if any certificate expires within 90 days\n- **PASS** if all certificates valid with 90+ days remaining\n\n**Remediation (self-hosted):** [managing-tls-certificates](../managing-tls-certificates/SKILL.md)\n\n**Cryptographic posture (both Cloud and self-hosted — informational only):**\n```bash\n# Primary: sslyze with STARTTLS postgres (if available)\nsslyze <host>:26257 --starttls postgres\n\n# Supplementary: openssl with STARTTLS postgres\nopenssl s_client -connect <host>:26257 -starttls postgres -showcerts -tlsextdebug 2>&1\n\n# PQC probe: offer ML-KEM hybrid, check if server accepts\nopenssl s_client -connect <host>:26257 -starttls postgres -groups X25519MLKEM768:x25519 2>&1\n```\n- **INFO** — TLS version (should be TLS 1.3; note if TLS 1.2 only)\n- **INFO** — PQC hybrid cipher support (e.g., X25519MLKEM768) — emerging, not yet a FAIL condition\n- **INFO** — Encryption key size (check for AES-256; note if AES-128)\n\n> **Note:** CockroachDB uses PostgreSQL wire protocol, so `openssl s_client` requires `-starttls postgres` to negotiate TLS correctly. Without this flag, the connection will fail. `sslyze` similarly requires `--starttls postgres`.\n\n### Step 7: Check Audit Logging\n\n```sql\n-- Check audit log configuration\nSHOW CLUSTER SETTING sql.log.user_audit;\n\n-- Check admin audit logging\nSHOW CLUSTER SETTING sql.log.admin_audit.enabled;\n```\n\n**Evaluate:**\n- **FAIL** if `sql.log.user_audit` is empty and `sql.log.admin_audit.enabled` is `false`\n- **WARN** if only admin audit is enabled but user audit is not configured\n- **PASS** if both user and admin audit logging are configured\n\n### Step 8: Assess Backup Status\n\n**Cloud clusters:** Managed backups are automatic — always PASS. Optionally check for self-managed schedules:\n```bash\nccloud cluster info <cluster-name> -o json  # Look for backup_config\n```\n```sql\nSHOW SCHEDULES;  -- Check for additional self-managed backup schedules\n```\n\n**Self-hosted clusters:** No managed backups — verify self-managed backup schedules:\n```sql\nSHOW SCHEDULES;\nSELECT id, label, schedule_status, next_run, created\nFROM [SHOW SCHEDULES]\nWHERE label ILIKE '%backup%' OR command @> '{\"backup\":{}}';\n```\n- **FAIL** if no backup schedules exist\n- **WARN** if schedules exist but show errors or haven't run recently\n- **PASS** if schedules are active and running\n\n**Remediation (self-hosted):**\n```sql\nCREATE SCHEDULE 'nightly-full-backup'\n  FOR BACKUP INTO 'gs://bucket/backups'\n  RECURRING '@daily'\n  WITH SCHEDULE OPTIONS first_run = 'now';\n```\n\n## Pass/Warn/Fail Criteria\n\n| Check | PASS | WARN | FAIL |\n|-------|------|------|------|\n| IP Allowlist | Specific CIDRs only | Broad ranges (/8, /16) | `0.0.0.0/0` present |\n| Cloud Console SSO | SSO enabled + enforced | SSO enabled, not enforced | Not configured |\n| Database SSO | Cluster SSO enabled | — | Not configured |\n| SCIM 2.0 | SCIM enabled + connected | — | Not enabled |\n| DB Auto User Provisioning | Identity mapping configured | — | Not configured |\n| Admin Users | 1-2 admins | 3-5 admins | 6+ admins |\n| PUBLIC Privileges | No data grants | USAGE-only grants | SELECT/INSERT/UPDATE/DELETE |\n| CMEK (Standard) | N/A | — | — (INFO: upgrade path) |\n| CMEK (Advanced + Security Add-on) | CMEK enabled | — | Not enabled |\n| Enterprise Encryption (self-hosted) | AES-256 enabled | Cannot determine | Not enabled (sensitive data) |\n| TLS (self-hosted) | Certs valid 90+ days | Certs expire in 30-90 days | Certs expire within 30 days |\n| TLS 1.3 / PQC / Key Size | — | — | — (INFO only) |\n| HBA (self-hosted) | Restrictive rules | Empty/default | — |\n| Audit Logging | User + admin audit on | Admin audit only | Disabled |\n| Password Policy | min length >= 12 | min length 8-11 | min length < 8 |\n| Backups (Cloud) | N/A | — | — (INFO: managed) |\n| Backups (self-hosted) | Schedules active | Schedules have errors | No schedules exist |\n\n## Severity Adjustments by Environment\n\nSeverity is calibrated for production by default. Non-production environments downgrade some findings. Compliance requirements override downgrades.\n\n| Check | Production | Staging | Development | Sandbox |\n|-------|-----------|---------|-------------|---------|\n| IP allowlist `0.0.0.0/0` (Cloud) | FAIL | FAIL | WARN | WARN |\n| No private endpoints on Advanced (Cloud) | WARN | WARN | INFO | INFO |\n| Empty HBA conf (self-hosted) | WARN | WARN | INFO | INFO |\n| SSO not configured | FAIL | FAIL | INFO | INFO |\n| SCIM not enabled | FAIL | FAIL | INFO | INFO |\n| Database SSO disabled | FAIL | FAIL | INFO | INFO |\n| Admin count 6+ | FAIL | FAIL | WARN | WARN |\n| CMEK not enabled (Cloud) | FAIL | FAIL | WARN | WARN |\n| Enterprise Encryption not enabled (self-hosted) | FAIL | FAIL | WARN | WARN |\n| Audit logging disabled | FAIL | FAIL | WARN | INFO |\n| No backup schedules (self-hosted) | FAIL | FAIL | WARN | INFO |\n\n**Compliance overrides** — these checks cannot be downgraded when a compliance framework is specified (compliance takes precedence over environment):\n\n| Framework | Non-Downgradable Checks |\n|-----------|------------------------|\n| SOC 2 | SSO, audit logging, admin users, password policy |\n| HIPAA | SSO, CMEK/Enterprise Encryption, audit logging, encryption, password policy, backups |\n| PCI DSS | IP allowlist/HBA, CMEK/Enterprise Encryption, audit logging, admin users, password policy, backups |\n| ISO 27001 | SSO, audit logging, admin users |\n| GDPR | Audit logging, encryption |\n\n**Annotations:** `*(downgraded from FAIL — development cluster)*` or `*(PCI DSS compliance — cannot downgrade)*`\n\n## Report Format\n\nSave each audit report to `reports/security-audit-<cluster-name>-<YYYY-MM-DD>-<sequence>.md` (gitignored, local-only). The `reports/` directory is not committed to version control — it serves as a local log for historical comparison and remediation tracking.\n\nGenerate a markdown report with the following structure:\n\n```\n# Security Audit Report — <Cluster Name>\n\n**Date:** YYYY-MM-DD\n**Cluster ID:** <cluster-id>\n**Plan:** Standard | Advanced | Self-hosted\n**CockroachDB Version:** vXX.X.X\n**Regions:** us-east-1, us-west-2\n**Deployment:** CockroachDB Cloud | Self-hosted\n**Environment:** production | staging | development | sandbox\n**Compliance:** SOC 2, PCI DSS | (none specified)\n**Data Sensitivity:** PII/PHI | financial | internal | public\n\n## Summary\n\n| Status | Count |\n|--------|-------|\n| PASS   | X     |\n| WARN   | X     |\n| FAIL   | X     |\n| INFO   | X     |\n| N/A    | X     |\n\n## Findings\n\n### Network Security\n- [PASS|WARN|FAIL|N/A] IP allowlist: <details>\n- [PASS|WARN|INFO|N/A] Private endpoints: <details>\n- [PASS|WARN|N/A] HBA configuration: <details>\n\n### Authentication & SSO\n- [PASS|FAIL|N/A] Cloud Console SSO: <details>\n- [PASS|FAIL] Database SSO (OIDC): <details>\n- [PASS|INFO] Database SSO (LDAP/AD): <details>\n- [PASS|FAIL|N/A] SCIM 2.0 provisioning: <details>\n- [PASS|FAIL] Auto user provisioning: <details>\n\n### Authorization\n- [PASS|WARN|FAIL] Admin user count: X users with admin role\n- [PASS|FAIL] PUBLIC role privileges: <details>\n\n### Encryption\n- [PASS|FAIL|INFO|N/A] CMEK: <details>\n- [PASS|FAIL|WARN|N/A] Enterprise Encryption: <details>\n- [PASS|FAIL|N/A] TLS: <details>\n- [INFO] Cryptographic posture: TLS version, PQC support, key size\n\n### Audit Logging\n- [PASS|WARN|FAIL] Audit log configuration: <details>\n\n### Backup & Recovery\n- [PASS|INFO|N/A] Managed backups: <details>\n- [PASS|WARN|FAIL|N/A] Self-managed backups: <details>\n\n### Cluster Configuration\n- [INFO] Version: vXX.X.X\n- [INFO] Plan: Standard | Advanced | Self-hosted\n- [INFO] Regions: <list>\n```\n\n**Status markers:** `[PASS]`, `[WARN]`, `[FAIL]`, `[INFO]`, `[N/A]`. Use `[N/A]` for checks that don't apply to the deployment model. Append severity adjustment annotations when applicable (see Severity Adjustments).\n\n## Remediation\n\nFor each finding, the corresponding remediation skill can be used independently:\n\n| Finding | Remediation Skill |\n|---------|------------------|\n| Open IP allowlist | [configuring-ip-allowlists](../configuring-ip-allowlists/SKILL.md) |\n| SSO not configured / SCIM not enabled | [configuring-sso-and-scim](../configuring-sso-and-scim/SKILL.md) |\n| CMEK not enabled | [enabling-cmek-encryption](../enabling-cmek-encryption/SKILL.md) |\n| Audit logging disabled | [configuring-audit-logging](../configuring-audit-logging/SKILL.md) |\n| Excessive admin privileges | [hardening-user-privileges](../hardening-user-privileges/SKILL.md) |\n| Weak password policy | [enforcing-password-policies](../enforcing-password-policies/SKILL.md) |\n| TLS/certificate issues | [managing-tls-certificates](../managing-tls-certificates/SKILL.md) |\n| No private connectivity | [configuring-private-connectivity](../configure-private-network/SKILL.md) |\n| Log export not configured | [configuring-log-export](../configuring-log-export/SKILL.md) |\n| Compliance gaps | [preparing-compliance-documentation](../prepare-compliance-docs/SKILL.md) |\n\nFor each FAIL finding, offer: **\"Explain how to fix this\"** (step-by-step guidance) or **\"Help me fix this now\"** (interactive remediation).\n\n## Safety Considerations\n\n- **All operations are read-only.** No cluster settings, users, roles, or network configurations are modified during the audit.\n- **SQL queries use SHOW and SELECT only.** No DDL or DML statements are executed.\n- **ccloud commands are read-only.** Only `list`, `info`, and `auth` subcommands are used.\n- **No secrets are logged.** Connection strings and tokens are not included in the report output.\n- **Privilege check:** The audit may produce incomplete results if the executing user lacks admin or VIEWACTIVITY privilege. The report notes any permission gaps.\n\n## References\n\n**Skill references:**\n- [Sample audit report](references/sample-report.md) — Example report with findings and remediation links\n- [SQL queries for security auditing](references/sql-queries.md)\n- [ccloud CLI commands](references/ccloud-commands.md)\n- [RBAC and privileges setup](references/permissions.md)\n\n**Remediation skills:**\n- [configuring-ip-allowlists](../configuring-ip-allowlists/SKILL.md) — Network access hardening\n- [enabling-cmek-encryption](../enabling-cmek-encryption/SKILL.md) — Customer-managed encryption keys\n- [configuring-audit-logging](../configuring-audit-logging/SKILL.md) — SQL audit logging\n- [hardening-user-privileges](../hardening-user-privileges/SKILL.md) — RBAC tightening\n- [enforcing-password-policies](../enforcing-password-policies/SKILL.md) — Password strength enforcement\n- [configuring-sso-and-scim](../configuring-sso-and-scim/SKILL.md) — SSO and SCIM provisioning\n- [managing-tls-certificates](../managing-tls-certificates/SKILL.md) — TLS certificate management\n- [configuring-private-connectivity](../configure-private-network/SKILL.md) — Private endpoints and VPC peering\n- [configuring-log-export](../configuring-log-export/SKILL.md) — Log and metric export\n- [preparing-compliance-documentation](../prepare-compliance-docs/SKILL.md) — Compliance readiness and documentation\n\n**Official CockroachDB Documentation:**\n- [CockroachDB Cloud Security Overview](https://www.cockroachlabs.com/docs/cockroachcloud/security-overview.html)\n- [Managing IP Allowlists](https://www.cockroachlabs.com/docs/cockroachcloud/network-authorization.html)\n- [Cloud Console SSO](https://www.cockroachlabs.com/docs/cockroachcloud/cloud-org-sso.html)\n- [Cluster SSO (Database SSO)](https://www.cockroachlabs.com/docs/stable/sso-sql.html)\n- [SCIM Provisioning](https://www.cockroachlabs.com/docs/cockroachcloud/configure-scim-provisioning)\n- [CMEK Overview](https://www.cockroachlabs.com/docs/cockroachcloud/cmek.html)\n- [Audit Logging](https://www.cockroachlabs.com/docs/stable/sql-audit-logging.html)\n- [Security Reference: Authorization](https://www.cockroachlabs.com/docs/stable/security-reference/authorization.html)\n"
}