Listing Thumbnail

    Baffle Shield for Postgres Static Data Masking to Lower Environments

     Info
    Free Trial
    A no-code solution for duplicating and anonymizing sensitive PostgreSQL data to development, testing or DevOps lower (pre-production) environments. Format Preserving Encryption (FPE) maintains the original data type and format enabling application and infrastructure testing.
    Listing Thumbnail

    Baffle Shield for Postgres Static Data Masking to Lower Environments

     Info

    Overview

    Baffle is the only security platform that cryptographically protects data as it's created, used, and shared across cloud-native data stores.

    Baffle Shield for Postgres Static Data Masking is specifically designed to copy and obfuscate sensitive production databases into development, testing, and DevOps lower environments. Eliminate the security and compliance issues with sensitive data in your pre-production environments.

    Baffle Shield is a proxy placed in-line between your production and pre-production databases and operates on the SQL commands. Use AWS DMS or native Postgres tools like pg_dump or pg_replication for migration (one-time or continuous updates)

    Format Preserving Encryption (FPE) protects data while preserving the original data type and length. This is critical for testing applications without modification as well as testing infrastructure for processing, storage, and bandwidth requirements. No corresponding token vault is required, eliminating the need to manage and secure that or worry about related performance issues. The data can be restored later if desired or the encryption key can be destroyed to ensure the data is never recovered. Envelope encryption ensures that Baffle software never has access to your key encryption keys (KEK), enabling you to bring your own keys (BYOK) in AWS KMS.

    Both source and target databases must be PostgreSQL (AWS EC2, RDS, or Aurora RDS). .

    Note! Baffle Manager is a web-based orchestration tool that configures, manages, and reports on Baffle Shields. Baffle Manager is free and also available in the AWS Marketplace.

    Highlights

    • Proxy architecture enables data duplication and protection with no modifications to production or lower environments. Use AWS DMS or Postgres standard backup. One-time copies and/or continual updates.
    • Tokenization using format preserving encryption (FPE) ensures security while maintaining the format and length of the original data. Applications and infrastructure do not need to be modified to continue working. There are no look-up tables or "vaults" to add management and security risks.
    • Envelope encryption ensures that Baffle software never has access to your key encryption keys (KEK), enabling you to bring your own keys (BYOK) in AWS KMS.

    Details

    Delivery method

    Delivery option
    64-bit (x86) Amazon Machine Image (AMI)

    Latest version

    Operating system
    CentOs 7

    Typical total price

    This estimate is based on use of the seller's recommended configuration (r6i.2xlarge) in the US East (N. Virginia) Region. View pricing details

    $3.504/hour

    Pricing

    Free trial

    Try this product at no cost for 30 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.

    Baffle Shield for Postgres Static Data Masking to Lower Environments

     Info
    Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covering your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
    Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator  to estimate your infrastructure costs.

    Usage costs (4)

     Info
    Instance type
    Product cost/hour
    EC2 cost/hour
    Total/hour
    t2.large
    $2.00
    $0.093
    $2.093
    r6i.2xlarge
    Recommended
    $3.00
    $0.504
    $3.504
    r6i.16xlarge
    $4.00
    $4.032
    $8.032
    r6i.32xlarge
    $5.00
    $8.064
    $13.064

    Additional AWS infrastructure costs

    Type
    Cost
    EBS General Purpose SSD (gp2) volumes
    $0.10/per GB/month of provisioned storage

    Vendor refund policy

    Free 30-day trial. Refunds are handled on a case-by-case basis via support.

    Legal

    Vendor terms and conditions

    Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .

    Content disclaimer

    Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.

    Usage information

     Info

    Delivery details

    64-bit (x86) Amazon Machine Image (AMI)

    Amazon Machine Image (AMI)

    An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.

    Version release notes

    Ongoing updates and improvements

    Additional details

    Usage instructions

    Start by launching Baffle Manager. Provide the Baffle Manager EC2 with a IAM role that provides access to a KMS key that will serve as the key encryption key, or KEK, S3 bucket for data encryption key (DEK) storage, and the target database -Use your browser to go to the URL of the Baffle Manager EC2 -Go through the configuration steps. -Create KMS, S3 and database connections. -Create an Application and retrieve the application SyncID.

    Start the Launch of Baffle Shield for Postgres Anonymization for Lower Environments providing the same IAM role access to KMS key, S3, and target dtabase. In addition, allow network access outbound of port 443 to Baffle Manager. -In "Advanced Details", enter the script #!/bin/bash sudo sh /home/baffle/ssl_setup.sh -b {s3-Bucket-Name} -s {SYNC_ID} subsituting the name of the S3 bucket and the SyncID from Baffle Manager (Or you can SSH into the Baffle Shield EC2 later using the username "baffle" and run the script)

    In Baffle Manager, you will see the BaffleShield connected to the Application you created.
    -In the application, select "Encrypt" and then navigate to the table to encrypt. Select the columns and encryption types. -Save and Deploy

    Connect AWS DMS ( or use Postgres native tools) to subscribe to the source database. Connect the Baffle Shield as the "Target" on port 8444. Baffle Shield in-turn will connect to the target database. All copies of the data will be encryptedby Shiled on the way to the target database.

    For TLS connectivity from AWS DMS to Shield, a certificate was generated and stored in the S3 bucket that can be used in AWS DMS. For TLS connectivity from Shield to the target database, select "Use SSL" when setting up the target database in Baffle Manger and upload the AWS RDS cert from here: https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-download-ssl-certificate-for-managed-database 

    Support

    Vendor support

    Email support for setup, configuration, and usage issues. support@baffle.io 

    AWS infrastructure support

    AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.

    Similar products

    Customer reviews

    Ratings and reviews

     Info
    0 ratings
    5 star
    4 star
    3 star
    2 star
    1 star
    0%
    0%
    0%
    0%
    0%
    0 AWS reviews
    No customer reviews yet
    Be the first to write a review for this product.