Nutanix Era is a software suite which automates and simplifies database management. It offers Database as a Service capabilities right from newly provisioned databases to managing new as well as existing ones. It automates database life cycle management operations like backup and restore, patching, archiving and so on. It also offers the ability to create space efficient database copies, refresh and restore them to any point in time.
Database Access
Enterprises typically have databases in the order of 100s if not more. This number goes up if we include related entities like standby or backup databases, retention policies, snapshots, etc. The ownership for these entities is spread across various business units in the enterprise and additionally over a wide variety of job functions like Infrastructure Admin, Database Admin, Developer and so on.In large enterprises, it is essential to control the level of access across users. For instance, hardware resources are costly, shared and in limited supply. We want to restrict a select group of users to manage them - someone like an Infrastructure Admin. On the other hand, entities like database patches or database backup retention policies are best defined by a Database Admin. These roles could have some overlapping functions but they are mostly independent.
Once the level of access is defined, enterprises want a way to define clear ownership for these databases and its associated entities. They need a clean way of defining ownership along with an easy interface to share entities across different groups within the enterprise. This is crucial to avoid resource bloat and data amplification. From a security point of view, these entities should only be visible to entity owner or users that share this entity. There is a clear need for isolation between entities across users.
Additionally, enterprises typically use external services like Active Directory for authentication and authorization. Authorization and access control for these database entities needs to be integrated with such services for ease of use.
Users, Roles and Privileges
Era offers these capabilities by organically embedding Role Based Access Control capabilities in the product. It offers the ability to add and remove users from Era, create and assign roles to users and associate various privileges with a role. A user can be assigned one or more roles and that gives him all the privileges encompassed by all his roles. For instance, if a user is assigned two roles - Infrastructure Admin and Database Admin, he has privileges to manage both physical resources like IP addresses and VLANs along with database entities like databases, time-machines, clones and so on.Era Role Based Access Control
Era allows assigning privileges to users through user roles. Era provides four out of the box roles. Each role is associated with a set of privileges. A user inherits all privileges that comes with his roles. Eventually customers should be able to create custom roles and assign privileges of choice to these roles. The out-of-box roles are:
- Super Admin
- Infrastructure Admin
- Database Infrastructure Admin
- Database Admin
As an example, here is the list of privileges associated with a Database Admin role.
Database Admin Privileges
Era offers a built-in ‘admin’ user which has Super Admin role and is immutable. Super Admin is the most powerful role in the system and come with all privileges built-in. Customers can create additional users with different roles. Era can authenticate and authorize these users locally or through an external directory service like Active Directory. Each user’s privileges will be determined based on the roles assigned to him.
User Addition
In addition to role based access control, all Era entities follow strict ownership model where users can only see entities that are created/owned by them. Common building blocks like Database Profiles are global and can be consumed by anyone (read-only), however, only the owner can modify/delete them. Users with ‘Super Admin’ role can view and modify entities across all users.
Let us take an example with three users - ‘era-dba’ is a Database Admin, ‘era-infra-admin’ is a Database Infrastructure Admin and ‘era-super-admin’ is a Super Admin user in Era. ‘era-dba’ and ‘era-infra-admin’ cannot see each others databases or backups. However, ‘era-super-admin’ user can see entities across both these users in addition to his own entities. Down the line Era will also allow sharing individual entities with one or more users with varying levels of permissions. Screenshots below highlight the difference in entities seen based on a users role.
Super Admin view of Databases
Database Admin view of Databases
In summary, Era offers a wide range of access control capabilities out of the box. It provides role assignment to restrict privileges and limits database access based on entity ownership. Era also integrates with external directory services for authentication and authorization.
2019 Nutanix, Inc. All rights reserved. Nutanix, the Nutanix logo and the other Nutanix products and features mentioned herein are registered trademarks or trademarks of Nutanix, Inc. in the United States and other countries. All other brand names mentioned herein are for identification purposes only and may be the trademarks of their respective holder(s).