Security Considerations

This change expands the collection’s database-administration surface. The main assets are Exasol credentials, authorization state, Ansible logs, and the integrity of automated schema, user, role, grant, and script execution workflows.

Security Assessment

• Affects Authentication / Authorization.

• Introduces or Modifies Sensitive Data Handling, Security-Relevant Processing, or Data Access Behavior.

• Impacts External Interfaces / APIs.

• Involves New Dependencies or Services.

• Affects Infrastructure or Configuration.

Other Security Considerations

• Data At Rest, PII, and Local Persistence.

• Accountability, Compliance, and Auditability.

• Availability and Failure Handling.

• Tier Segregation and Trusted-Operator Boundary.

Residual Risk

exasol_query intentionally enables operator-supplied SQL execution today, and any future exasol_script module would do the same for a broader trusted-operator surface. The security boundary is therefore operator authorization, secret-safe handling, and transport protection, not restriction of SQL semantics inside the module.

Trusted operators can still intentionally or accidentally execute destructive SQL. This risk is accepted as part of the module’s purpose and must be managed operationally through least privilege, review of playbooks, and controlled execution environments.