Listing Thumbnail

    Baffle Shield for Postgres Dynamic Data Masking

     Info
    Free Trial
    Baffle Shield for Postgres Data Masking enables a no-code solution for database encryption and/or tokenization, and masking with role-based access control.
    Listing Thumbnail

    Baffle Shield for Postgres Dynamic Data Masking

     Info

    Overview

    Baffle is the only security platform that cryptographically protects data as it's created, used, and shared across cloud-native data stores.

    Baffle Shield for Postgres Dynamic Data Masking is a proxy between your applications and Postgres databases. Data in databases is encrypted or tokenized for protection of data-at-rest. Data-in-use is decrypted and/or masked according to role-based access controls (RBAC) for protection. The masking can vary based on the data itself and the role of the applications or users. Marketing might see credit card numbers (CCN) as "confidential" but the payment applications get the CCN in the clear. Support is able to see the first six and last four digits (4444-44XX-XXXX-4444) for customer verification. This is the solution for compliance to security and privacy regulations such as PCI-DSS, HIPAA, GDPR, and CCPA.

    The Baffle proxy intercepts SQL queries from the application and performs the key management, encryption/decryption, and RBAC masking in real-time. This means no or minimal code changes to your applications for easy implementation. A two-tiered key system means you control the key encryption keys, but do not have to manage the data encryption keys. The proxy architecture is modular, allowing you to scale with your performance and availability needs.

    Note! Baffle Manager is a web-based GUI to configure, manage, and report on Baffle Shields. Baffle Manager is free and must be installed first.

    Highlights

    • Proxy-based architecture for no-code implementation minimizes impact to your applications and infrastructure but enables maximum flexibility to scale for performance and availability.
    • Flexible masking using role-based access control ensures security and privacy compliance to PCI-DSS, HIPAA, GDPR, CCPA and more. Finally eliminate the impacts of data breaches.
    • Baffle's two-tiered key system allows you to bring your own keys (BYOK) or hold your own keys (HYOK). At the same time, Shield manages the data encryption keys, freeing your applications from the need to map or manage any keys.

    Details

    Delivery method

    Delivery option
    64-bit (x86) Amazon Machine Image (AMI)

    Latest version

    Operating system
    CentOs 7

    Typical total price

    This estimate is based on use of the seller's recommended configuration (r6i.2xlarge) in the US East (N. Virginia) Region. View pricing details

    $3.504/hour

    Pricing

    Free trial

    Try this product at no cost for 30 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.

    Baffle Shield for Postgres Dynamic Data Masking

     Info
    Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time. Alternatively, you can pay upfront for a contract, which typically covering your anticipated usage for the contract duration. Any usage beyond contract will incur additional usage-based costs.
    Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator  to estimate your infrastructure costs.

    Usage costs (4)

     Info
    Instance type
    Product cost/hour
    EC2 cost/hour
    Total/hour
    t2.large
    $2.00
    $0.093
    $2.093
    r6i.2xlarge
    Recommended
    $3.00
    $0.504
    $3.504
    r6i.16xlarge
    $4.00
    $4.032
    $8.032
    r6i.32xlarge
    $5.00
    $8.064
    $13.064

    Additional AWS infrastructure costs

    Type
    Cost
    EBS General Purpose SSD (gp2) volumes
    $0.10/per GB/month of provisioned storage

    Vendor refund policy

    Free 30 day trial. Refunds are handled on a case-by-case basis via support.

    Legal

    Vendor terms and conditions

    Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .

    Content disclaimer

    Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.

    Usage information

     Info

    Delivery details

    64-bit (x86) Amazon Machine Image (AMI)

    Amazon Machine Image (AMI)

    An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.

    Version release notes

    Initial Offering

    Additional details

    Usage instructions

    Baffle Manager is a different AWS Marketplace listing that must be installed first. It is a free web-based configuration and management tool for all Baffle Shields. Launch the Baffle Manager AMI on the EC2 or your choice. Ensure that your computer can access port 443 of the EC2 Open a browser and navigate to the EC2 IP address Configure Baffle Manager as per the instructions Setup a keystore Setup a database Create an application and note the SyncID Once you have the SyncID from Baffle Manager, then launch an EC2 with this Baffle Shield listing. Ensure that this EC2 can connect outbound to the ECS (port 443) that has Baffle Manager installed. Have an S3 bucket ready that can hold a TLS certificate that will be generated and can be used for a TLS connection from your applications to Baffle Shield. In the User Data box, paste this command and substitute the S3 bucket name and SyncID (without brackets).

    #!/bin/bash sudo sh /home/baffle/ssl_setup.sh -b {s3-Bucket-Name} -s {SYNC_ID}

    Data Encryption Configuration Go back to the Baffle Manager GUI and ensure the Shield appears in the Shield listings. Go back to Applications and select the relevant one from the list. A window will appear from the right. Click Encrypt In the lower left corner, define any masking and RBAC policies required. In the top left, the connected database will appear. Click on it and navigate down to the table where you wish to encrypt data. Select the columns to apply encryption to as well as any masking. Then for each column, click into the small window for each and select the encryption and masking policies. When done, click Review in the bottom right. Select Deploy and Migrate. The database will be encrypted.
    When a user or application connects to the database through Baffle Shield, the RBAC and masking policies will be applied.

    Baffle Shield Status In the left navigation of Baffle Manager, click Application Click on the relevant application. A window slides in from the right. Look for the indication that Baffle Shield in still active.

    Support

    Vendor support

    Email support for setup, configuration, and usage issues. support@baffle.io  support@baffle.io 

    AWS infrastructure support

    AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.

    Similar products

    Customer reviews

    Ratings and reviews

     Info
    0 ratings
    5 star
    4 star
    3 star
    2 star
    1 star
    0%
    0%
    0%
    0%
    0%
    0 AWS reviews
    No customer reviews yet
    Be the first to write a review for this product.