Security Considerations

This change expands the collection’s database-administration surface. The main assets are Exasol credentials, authorization state, Ansible logs, and the integrity of automated schema, user, role, grant, and script execution workflows.

Security Assessment

• Affects Authentication / Authorization.

• Introduces or Modifies Sensitive Data Handling, Security-Relevant Processing, or Data Access Behavior.

• Impacts External Interfaces / APIs.

• Involves New Dependencies or Services.

• Affects Infrastructure or Configuration.

Other Security Considerations

• Data At Rest, PII, and Local Persistence.

• Accountability, Compliance, and Auditability.

• Availability and Failure Handling.

• Tier Segregation and Trusted-Operator Boundary.

Residual Risk

exasol_query and exasol_script intentionally enable operator-supplied SQL execution, the latter for multi-statement scripts. The security boundary is therefore operator authorization, secret-safe handling, and transport protection, not restriction of SQL semantics inside either module.

Trusted operators can still intentionally or accidentally execute destructive SQL. This risk is accepted as part of the module’s purpose and must be managed operationally through least privilege, review of playbooks, and controlled execution environments.