DCT Compliance requires a database user account with sufficient privileges to perform discovery and masking operations.
When a connector is configured, the database credentials provided in the connector must belong to a user with the required permissions on the target schemas and tables.
Delphix recommends creating a dedicated database user for masking operations. This user should have the appropriate privileges on the schemas that will be processed by Continuous Compliance.
Using a dedicated masking user provides several advantages:
-
User privileges can be managed and replicated more easily across environments.
-
The account can be centrally managed using directory services such as Active Directory.
-
Database access audits and activity tracking become simpler and easier to manage.
The specific permissions required depend on whether the operation performs discovery or masking.
Permissions required for masking jobs
Masking operations modify data within the database. The masking user should have permissions that allow reading and updating table data as well as modifying related database objects.
Typical permissions required for masking jobs include:
-
Read data from tables
-
Write data to tables
-
Update table data
-
Create indexes
-
Drop indexes
-
Create triggers
-
Drop triggers
-
Enable or disable triggers
-
Alter tables add column
-
Alter tables delete column
-
Create constraints
-
Delete constraints
-
Enable or disable constraints
Permissions required for discovery jobs
Discovery operations analyze database metadata and data values in order to identify sensitive data.
Typical permissions required for discovery jobs include:
-
View schema definitions
-
Read data from tables
Database-specific permission requirements
The exact permissions required may vary depending on the database platform. Refer to the following topics for database-specific configuration instructions: