Ensure that every read replica carries the same public access restriction and network access rules as its primary, so that the replicated data is not reachable under weaker protection.
Apply Primary Protections to Read Replicas
CCC.RDMS.CN11 · Data
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP15 | Horizontal Scaling | The service may be configured to create read replicas of the primary database, in the same or another region, to serve read traffic. |
| CCC.Core.CP08 | Data Replication | The service automatically replicates data across multiple deployments simultaneously with parity, or may be configured to do so. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.TH11 | Read Replicas are Deployed with Weaker Protections | A read replica may be created with network access rules or public accessibility that differ from the primary. The same data is then reachable through the replica under weaker protection, impacting its confidentiality. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.RDMS.CN11.AR01 | When a read replica is created, its public access restriction MUST be at least as restrictive as that of the primary. | tlp-green, tlp-amber, tlp-red |
| CCC.RDMS.CN11.AR02 | When a read replica is created, its network access rules MUST permit no source that the primary's rules do not permit. | tlp-green, tlp-amber, tlp-red |