A protocol-aware proxy that enforces database access policies using Open Policy Agent (OPA) for data security and compliance.
Inspektor is a protocol-aware proxy that enforces access policies on database queries to secure data assets and ensure compliance. It intercepts database traffic and validates queries against policies defined using Open Policy Agent (OPA), supporting databases like PostgreSQL, MySQL, and MongoDB. The tool helps organizations prevent unauthorized data access, manage permissions centrally, and protect sensitive information such as PII.
DevOps engineers, database administrators, and security teams in organizations that need fine-grained, centralized control over database access across multiple data sources. It's also useful for developers who require temporary access credentials for debugging without compromising security.
Developers choose Inspektor for its integration with OPA, which allows flexible, declarative policy definitions, and its protocol-aware architecture that works across multiple databases. Unlike siloed solutions, it provides a centralized control plane for managing all data policies, reducing complexity and improving security posture.
Inspektor is a protocol-aware proxy that is used to enforce access policies👮
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Open Policy Agent with Rego language, enabling declarative and context-aware policies, such as granting access based on support ticket assignments, as shown in the example policy.
Control plane allows managing all data access policies from a single interface, eliminating siloed configurations across multiple databases, which simplifies compliance and auditing.
Intercepts and analyzes database network traffic at the protocol level, enforcing policies before queries reach the data source, preventing unauthorized access like accidental DELETE commands.
Enables hiding or restricting specific columns like PII based on user roles, as demonstrated in the OPA example policy that protects customer email columns for support roles.
Currently only supports PostgreSQL, with other databases like MySQL and MongoDB still in the planned stage, restricting immediate adoption for multi-database environments.
Requires deploying both control and data plane components, which adds operational overhead and complexity compared to built-in database security solutions.
Writing policies in Rego can be challenging for teams unfamiliar with OPA, increasing the initial learning investment and potential for misconfiguration.