Overview
Baffle is the only security platform that cryptographically protects data as it's created, used, and shared across cloud-native data stores.
Baffle Shield for Postgres Dynamic Data Masking is a proxy between your applications and Postgres databases. Data in databases is encrypted or tokenized for protection of data-at-rest. Data-in-use is decrypted and/or masked according to role-based access controls (RBAC) for protection. The masking can vary based on the data itself and the role of the applications or users. Marketing might see credit card numbers (CCN) as "confidential" but the payment applications get the CCN in the clear. Support is able to see the first six and last four digits (4444-44XX-XXXX-4444) for customer verification. This is the solution for compliance to security and privacy regulations such as PCI-DSS, HIPAA, GDPR, and CCPA.
The Baffle proxy intercepts SQL queries from the application and performs the key management, encryption/decryption, and RBAC masking in real-time. This means no or minimal code changes to your applications for easy implementation. A two-tiered key system means you control the key encryption keys, but do not have to manage the data encryption keys. The proxy architecture is modular, allowing you to scale with your performance and availability needs.
Note! Baffle Manager is a web-based GUI to configure, manage, and report on Baffle Shields. Baffle Manager is free and must be installed first.
Highlights
- Proxy-based architecture for no-code implementation minimizes impact to your applications and infrastructure but enables maximum flexibility to scale for performance and availability.
- Flexible masking using role-based access control ensures security and privacy compliance to PCI-DSS, HIPAA, GDPR, CCPA and more. Finally eliminate the impacts of data breaches.
- Baffle's two-tiered key system allows you to bring your own keys (BYOK) or hold your own keys (HYOK). At the same time, Shield manages the data encryption keys, freeing your applications from the need to map or manage any keys.
Details
Typical total price
$3.504/hour
Pricing
Free trial
Instance type | Product cost/hour | EC2 cost/hour | Total/hour |
|---|---|---|---|
t2.large | $2.00 | $0.093 | $2.093 |
r6i.2xlarge Recommended | $3.00 | $0.504 | $3.504 |
r6i.16xlarge | $4.00 | $4.032 | $8.032 |
r6i.32xlarge | $5.00 | $8.064 | $13.064 |
Additional AWS infrastructure costs
Type | Cost |
|---|---|
EBS General Purpose SSD (gp2) volumes | $0.10/per GB/month of provisioned storage |
Vendor refund policy
Free 30 day trial. Refunds are handled on a case-by-case basis via support.
Legal
Vendor terms and conditions
Content disclaimer
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Initial Offering
Additional details
Usage instructions
Baffle Manager is a different AWS Marketplace listing that must be installed first. It is a free web-based configuration and management tool for all Baffle Shields. Launch the Baffle Manager AMI on the EC2 or your choice. Ensure that your computer can access port 443 of the EC2 Open a browser and navigate to the EC2 IP address Configure Baffle Manager as per the instructions Setup a keystore Setup a database Create an application and note the SyncID Once you have the SyncID from Baffle Manager, then launch an EC2 with this Baffle Shield listing. Ensure that this EC2 can connect outbound to the ECS (port 443) that has Baffle Manager installed. Have an S3 bucket ready that can hold a TLS certificate that will be generated and can be used for a TLS connection from your applications to Baffle Shield. In the User Data box, paste this command and substitute the S3 bucket name and SyncID (without brackets).
#!/bin/bash sudo sh /home/baffle/ssl_setup.sh -b {s3-Bucket-Name} -s {SYNC_ID}
Data Encryption Configuration
Go back to the Baffle Manager GUI and ensure the Shield appears in the Shield listings.
Go back to Applications and select the relevant one from the list. A window will appear from the right. Click Encrypt
In the lower left corner, define any masking and RBAC policies required.
In the top left, the connected database will appear. Click on it and navigate down to the table where you wish to encrypt data.
Select the columns to apply encryption to as well as any masking. Then for each column, click into the small window for each and select the encryption and masking policies.
When done, click Review in the bottom right.
Select Deploy and Migrate. The database will be encrypted.
When a user or application connects to the database through Baffle Shield, the RBAC and masking policies will be applied.
Baffle Shield Status In the left navigation of Baffle Manager, click Application Click on the relevant application. A window slides in from the right. Look for the indication that Baffle Shield in still active.
Resources
Vendor resources
Support
Vendor support
Email support for setup, configuration, and usage issues. support@baffle.io support@baffle.io
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
