Documentation

1. Purpose

This guide describes how to configure a read-only MariaDB database user and connect the CBOM Discover_DB sensor to a MariaDB instance that uses Data-at-Rest Encryption (TDE). The sensor discovers cryptographic assets managed by MariaDB's encryption key management plugins, including:

Active encryption key identifiers and versions managed by file_key_management or aws_key_management plugins
Tablespace-level encryption status for InnoDB tables via information_schema.INNODB_TABLESPACES_ENCRYPTION
Plugin state and key management backend configuration
Per-table and per-tablespace encryption metadata

The CBOM sensor connects in read-only mode and does not modify any database state, keys, or encryption configuration.

2. Prerequisites

Before beginning this setup, ensure the following conditions are met:

MariaDB version 10.1.3 or later is installed and running with Data-at-Rest Encryption enabled.
At least one encryption key management plugin is active: file_key_management or aws_key_management.
You have access to a MariaDB administrative account (e.g., root) capable of creating users and granting privileges.
The CBOM platform is deployed and the Discover_DB sensor module is available.
Network connectivity exists between the CBOM sensor host and the MariaDB server on the configured port (default: 3306).
If TLS is required for the connection, a valid server certificate and CA certificate are available.
The information_schema tables related to encryption (INNODB_TABLESPACES_ENCRYPTION) are accessible on your MariaDB build (requires InnoDB with encryption support compiled in).

3. Create the CBOM Reader User

3.1 Connect to MariaDB as an Administrator

Open a terminal on the MariaDB host or any host with mariadb or mysql client access.
Connect to the MariaDB server using an administrative account:

mariadb -u root -p -h <mariadb-host> -P 3306

Confirm you are connected to the correct server:

SELECT @@hostname, VERSION();

3.2 Create the Dedicated CBOM User

Create a new user account scoped for the CBOM sensor. Replace 'StrongPassword123!' with a securely generated password:

CREATE USER 'cbom_reader'@'%' IDENTIFIED BY 'StrongPassword123!';

If you want to restrict connections to a specific CBOM sensor host IP instead of any host, replace '%' with the sensor's IP address:

CREATE USER 'cbom_reader'@'cbom-agent.example.com' IDENTIFIED BY 'StrongPassword123!';

Verify the user was created successfully:

SELECT User, Host FROM mysql.user WHERE User = 'cbom_reader';

4. Grant Required Privileges

4.1 Grant Encryption Metadata Access

Grant SELECT on the InnoDB tablespace encryption metadata view:

GRANT SELECT ON information_schema.INNODB_TABLESPACES_ENCRYPTION TO 'cbom_reader'@'%';

Grant the PROCESS privilege so the sensor can enumerate running threads and plugin state:

GRANT PROCESS ON *.* TO 'cbom_reader'@'%';

Flush privileges to ensure the grants take effect immediately:

FLUSH PRIVILEGES;

4.2 Verify Granted Privileges

Confirm the privileges are correctly assigned:

SHOW GRANTS FOR 'cbom_reader'@'%';

Expected output should include lines similar to:

GRANT PROCESS ON *.* TO 'cbom_reader'@'%'
GRANT SELECT ON `information_schema`.`INNODB_TABLESPACES_ENCRYPTION` TO 'cbom_reader'@'%'

5. Verify Encryption Plugin Status

5.1 Confirm Key Management Plugin is Active

While still connected as the administrator, check which key management plugins are loaded:

SHOW PLUGINS SONAME LIKE '%key_management%';

Review the output. An active plugin will show ACTIVE in the Status column:

+---------------------------+--------+--------------------+--------------------------+---------+
| Name                      | Status | Type               | Library                  | License |
+---------------------------+--------+--------------------+--------------------------+---------+
| file_key_management       | ACTIVE | ENCRYPTION         | file_key_management.so   | GPL     |
+---------------------------+--------+--------------------+--------------------------+---------+

If the plugin shows DISABLED or is absent, encryption is not active. Refer to the MariaDB documentation to enable the plugin in my.cnf before proceeding.

5.2 Verify Encrypted Tablespaces Are Visible

Run a quick check to confirm encrypted tablespace records are present:

SELECT SPACE, NAME, ENCRYPTION_SCHEME, KEY_ID
FROM information_schema.INNODB_TABLESPACES_ENCRYPTION
LIMIT 10;

Rows returned indicate that InnoDB tablespace encryption metadata is accessible and the CBOM sensor will be able to discover key IDs in use.

6. Configure CBOM Sensor

Add a new sensor entry to your CBOM sensor configuration file (typically sensors.yaml or the platform's sensor configuration UI). Use the values appropriate for your environment:

sensors:
  - name: mariadb-tde-production
    type: Discover_DB
    enabled: true
    schedule: "0 */6 * * *"        # Run every 6 hours
    connection:
      vendor: mariadb
      host: mariadb-prod.internal.example.com
      port: 3306
      database: information_schema
      username: cbom_reader
      password: "{{ vault.mariadb_cbom_reader_password }}"
      tls:
        enabled: true
        ca_cert: /etc/cbom/certs/mariadb-ca.pem
        verify_server_cert: true
    discovery:
      targets:
        - innodb_tablespaces_encryption
        - plugin_status
      key_management_plugin: file_key_management  # or aws_key_management
      include_unencrypted_tablespaces: false
    output:
      cbom_asset_types:
        - symmetric_key
        - encryption_scheme
      tag_with:
        environment: production
        team: platform-security
        data_sensitivity: high
    timeout_seconds: 30
    max_retries: 3

Replace placeholder values as follows:

mariadb-prod.internal.example.com — hostname or IP of the MariaDB server
{{ vault.mariadb_cbom_reader_password }} — reference to your secrets manager entry for the cbom_reader password
/etc/cbom/certs/mariadb-ca.pem — path to the CA certificate used to verify the MariaDB server's TLS certificate
key_management_plugin — set to either file_key_management or aws_key_management depending on your deployment

7. Validation

After saving the sensor configuration, perform the following steps to confirm the sensor is operating correctly:

Trigger a manual sensor run from the CBOM platform UI or CLI:

cbom sensor run --name mariadb-tde-production

Check the sensor run logs for a successful connection message:

[INFO] Discover_DB: Connected to mariadb-prod.internal.example.com:3306 as cbom_reader
[INFO] Discover_DB: Plugin 'file_key_management' status: ACTIVE
[INFO] Discover_DB: Discovered 42 encrypted tablespaces with 3 unique KEY_IDs
[INFO] Discover_DB: Asset ingestion complete — 45 cryptographic assets recorded

Navigate to the CBOM asset inventory and filter by source mariadb-tde-production. Confirm that symmetric key entries and encryption scheme records appear.
Optionally, validate the sensor user can query the required table directly:

mariadb -u cbom_reader -p -h mariadb-prod.internal.example.com \
  -e "SELECT COUNT(*) FROM information_schema.INNODB_TABLESPACES_ENCRYPTION;"

A numeric result confirms read access is working correctly.

8. Common Errors and Resolution

Error 1: Access Denied for INNODB_TABLESPACES_ENCRYPTION

ERROR 1142 (42000): SELECT command denied to user 'cbom_reader'@'...' for table 'INNODB_TABLESPACES_ENCRYPTION'

Cause: The SELECT privilege on information_schema.INNODB_TABLESPACES_ENCRYPTION was not granted, or the grant was applied to a different host pattern than the one the sensor is connecting from.

Fix: Re-run the grant statement using the exact host or '%', then flush privileges:

GRANT SELECT ON information_schema.INNODB_TABLESPACES_ENCRYPTION TO 'cbom_reader'@'%';
FLUSH PRIVILEGES;

Error 2: Encryption Plugin Not Found or Inactive

[ERROR] Discover_DB: Key management plugin 'file_key_management' not found or status is not ACTIVE

Cause: The encryption plugin is not loaded in MariaDB, or the plugin_load_add directive is missing from my.cnf.

Fix: Add the plugin directive to /etc/mysql/my.cnf or /etc/my.cnf under [mysqld] and restart MariaDB:

[mysqld]
plugin_load_add = file_key_management
file_key_management_filename = /etc/mysql/encryption/keyfile
file_key_management_encryption_algorithm = AES_CBC

systemctl restart mariadb

Then re-verify with SHOW PLUGINS SONAME LIKE '%key_management%';.

Error 3: TLS Handshake Failure

[ERROR] Discover_DB: TLS connection failed — certificate verify failed: unable to get local issuer certificate

Cause: The CA certificate specified in the sensor configuration does not match the certificate authority that signed the MariaDB server's TLS certificate, or the CA cert file path is incorrect.

Fix: Obtain the correct CA certificate from the team that manages the MariaDB server's TLS configuration. Update the ca_cert path in sensors.yaml to point to the correct file:

openssl s_client -connect mariadb-prod.internal.example.com:3306 -starttls mysql 2>/dev/null \
  | openssl x509 -noout -issuer -subject

Use the issuer information to locate or export the correct CA certificate, then restart the CBOM sensor.

9. Security Recommendations

Use a dedicated, least-privilege account. The cbom_reader user should never be granted SUPER, FILE, or any write privilege. Restrict the host pattern to the CBOM sensor's IP rather than using '%' in production environments.
Store credentials in a secrets manager. Do not store the cbom_reader password in plaintext in sensors.yaml. Use a secrets manager reference (e.g., HashiCorp Vault, AWS Secrets Manager) and rotate the password on a regular schedule.
Enforce TLS for all sensor connections. Set tls.enabled: true and verify_server_cert: true in the sensor configuration to prevent credential exposure and man-in-the-middle attacks on the database connection.
Audit sensor activity. Enable MariaDB's general or audit log plugin and configure it to record queries from the cbom_reader user. Periodically review logs to confirm the sensor is only issuing expected SELECT statements against information_schema.
Rotate encryption keys regularly. Use the CBOM inventory to identify key IDs that have not been rotated within your policy window. MariaDB supports key version rotation via the key management plugin; automate rotation and verify that the CBOM asset record updates to reflect the new key version.

10. Conclusion

This guide has walked through the complete setup required to connect the CBOM Discover_DB sensor to a MariaDB instance using Data-at-Rest Encryption. By creating a scoped cbom_reader user with minimal privileges and configuring the sensor with TLS-secured credentials, the CBOM platform can continuously discover and track encryption key usage and tablespace encryption status without impacting database operations. Regular validation runs and adherence to the security recommendations above will ensure the integration remains accurate, secure, and aligned with your organization's cryptographic governance policies.

CBOM Secure

MariaDB Setup Guide for CBOM Database TDE Sensor