DataHub security and compliance

1.1 Authentication

DataHub supports multiple user identities, including Alibaba Cloud accounts, RAM users, and RAM roles. It also supports authentication using AccessKey pairs, Multi-Factor Authentication (MFA), and delegated authorization through Security Token Service (STS), which provides an authorization solution for accessing external data sources. For more information, see the following topics:

• Access control

• AccessKey management

• RAM role overview

• Concepts of STS and temporary access credentials

1.2 Authorization

DataHub integrates with Resource Access Management (RAM) to support resource-level authorization for projects, topics, and subscriptions. With RAM authorization, you can precisely control which resources an account can access and which operations it can perform. This enables you to implement the principle of least privilege. For more information, see Access control.

DataHub supports the following security conditions.

1.3 IP whitelist

You can use RAM to restrict access based on source IP addresses and VPC IDs. You can also apply these restrictions to a specific AccessKey. IPv6 is not currently supported.

For more information, see Elements of a permission policy and Network access control policies for an AccessKey.

2.1 Encryption in transit

DataHub provides both public and VPC domain names. Connections over a VPC use dedicated Alibaba Cloud network tunnels. When you connect to DataHub using an SDK, OpenAPI, or other method, you must use HTTPS with TLS v1.2. This prevents data interception or tampering during transmission. For more information, see DataHub domain names.

2.2 Data storage integrity and confidentiality

DataHub uses a distributed file system to automatically create multiple replicas of your data. By default, DataHub creates three replicas. It distributes these replicas across different physical machines and racks to prevent data loss from a single point of failure, ensuring data durability and integrity.

DataHub stores data in the Apsara Distributed File System. The system provides a flat, linear storage space that is divided into slices called chunks. The system replicates each chunk three times. It stores these replicas on different nodes across the cluster according to specific placement policies to prevent data unavailability caused by a single chunk server or rack failure. The system synchronizes all user operations, such as adding, modifying, or deleting data, across all three replicas to ensure data integrity and consistency. When a user deletes data, the system reclaims the storage space, prohibits further access, and erases the data to ensure that it cannot be restored.

3.1 Supported metrics

In the console, you can view multiple metrics for read and write operations, including QPS, RPS, throughput, uncompressed throughput, latency, and failures. Historical traffic trends are also available.

DataHub integrates all metrics with CloudMonitor. You can retrieve metric data directly by using the CloudMonitor API.

3.2 Supported alarm types

You can configure alarms in CloudMonitor for all integrated metrics. For example, you can set an alarm that triggers when throughput exceeds a specified threshold. You can also configure threshold alarms for consumption latency and backlog. For more information, see CloudMonitor alerting.

3.3 Audit logs

DataHub integrates with ActionTrail.