BYOC security playbook

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/security/05_audit_logging/03_byoc-security-playbook.md)

ClickHouse operates Bring Your Own Cloud (BYOC) under a security shared responsibility model, which can be downloaded from our Trust Center at <https://trust.clickhouse.com>. The following information is provided for BYOC customers as examples of how to identify potential security events. Customers should consider this information in the context of their security program to determine if additional detections and alerts may be helpful.

## Potentially compromised ClickHouse credentials[​](#compromised-clickhouse-credentials "Direct link to Potentially compromised ClickHouse credentials")

Refer to the [database audit log](/docs/cloud/security/audit-logging/database-audit-log) documentation for queries to detect credential based attacks and queries to investigate malicious activities.

## Application layer denial of service attack[​](#application-layer-dos-attack "Direct link to Application layer denial of service attack")

There are various methods to execute a Denial of Service (DoS) attack. If the attack is focused on crashing the ClickHouse instance through a specific payload, recover the system back to a running state, or reboot the system and restrict access to regain control. Use the following query to review the [system.crash\_log](/docs/operations/system-tables/crash_log) to get more information about the attack.

```
SELECT * 
FROM clusterAllReplicas('default',system.crash_log)
```

## Compromised ClickHouse created AWS roles[​](#compromised-clickhouse-created-aws-roles "Direct link to Compromised ClickHouse created AWS roles")

ClickHouse utilizes pre-created roles to enable system functions. This section assumes the customer is using AWS with CloudTrail and has access to the CloudTrail logs.

If an incident may be the result of a compromised role, review activities in CloudTrail and CloudWatch related to the ClickHouse IAM roles and actions. Refer to the [CloudFormation](/docs/cloud/reference/byoc/reference/privilege#cloudformation-iam-roles) stack or Terraform module provided as part of setup for a list of IAM roles.

## Unauthorized access to EKS cluster[​](#unauthorized-access-eks-cluster "Direct link to Unauthorized access to EKS cluster")

ClickHouse BYOC runs inside EKS. This section assumes the customer is using CloudTrail and CloudWatch in AWS and has access to the logs.

If an incident may be the result of a compromised EKS cluster, use the queries below within the EKS CloudWatch logs to identify specific threats.

List the number of Kubernetes API calls by username

```
fields user.username
| stats count(*) as count by user.username
```

Identify whether a user is a ClickHouse engineer

```
fields @timestamp,user.extra.sessionName.0, requestURI, verb,userAgent, @message, @logStream, @log
| sort @timestamp desc
| filter user.username like /clickhouse.com/
| limit 10000
```

Review user accessing Kubernetes secrets, filter out service roles

```
fields @timestamp,user.extra.sessionName.0, requestURI, verb,userAgent, @message, @logStream, @log
| sort @timestamp desc
| filter requestURI like /secret/
| filter verb="get"
| filter ispresent(user.extra.sessionName.0)
| filter user.username not like /ClickHouseManagementRole/
| filter user.username not like /data-plane-mgmt/
```

- [Potentially compromised ClickHouse credentials](#compromised-clickhouse-credentials)- [Application layer denial of service attack](#application-layer-dos-attack)- [Compromised ClickHouse created AWS roles](#compromised-clickhouse-created-aws-roles)- [Unauthorized access to EKS cluster](#unauthorized-access-eks-cluster)

Was this page helpful?