CockroachDB Cloud

Tidal Control's CockroachDB Cloud integration reads security and compliance evidence from your CockroachDB Cloud organisation. It authenticates with an API key belonging to a service account, and covers cluster inventory and data residency, network restrictions, managed backups, encryption, log export and the organisation audit log.

What this integration monitors

• Clusters: Plan type, cloud provider, regions and data residency, version currency and delete protection
• Databases and SQL users: The inventory on each cluster
• Network: IP allowlist entries, whether any range is open to the world, and PrivateLink endpoint services
• Backups: Whether managed backups are enabled, their frequency and retention
• Encryption: Customer-managed encryption keys per region, on Advanced-tier clusters
• Log export: Whether cluster logs reach an external sink, and whether delivery is healthy
• Access: API keys, service accounts, and organisation role grants including SSO-group inheritance
• Audit log: Who changed what, from which address

Requirements

• Super User role in Tidal Control
• A CockroachDB Cloud organisation
• Permission to create a service account under Access Management

Choosing roles for the service account

An API key is scoped to one organisation, so no separate organisation or account ID is needed. What the key can read depends entirely on the roles you give its service account, and the right combination depends on whether your organisation offers the Auditor role at all.

Roles	Write access	Coverage
Auditor + Cluster Developer (preferred)	None	Everything, including the audit log
Cluster Developer only	None	Everything except the audit log
Org Admin + Cluster Admin	Yes, both roles can change things	Everything, including the audit log

The split is worth stating because it is not obvious: Cluster Developer carries the cluster inventory, databases and SQL users, while Auditor carries backups, encryption keys, log export, API keys, service accounts, role grants and the audit log. Neither reaches everything on its own, and neither can change anything.

If you cannot select Auditor

Only Org Admin and Auditor can read the organisation audit log, so without Auditor you have to choose which trade-off you prefer:

• Cluster Developer alone (recommended). The key stays read-only. Every check works except Audit log records recent activity, which fails because no events can be fetched. That failure is honest: it reports that the evidence is missing rather than passing while having verified nothing.
• Org Admin + Cluster Admin. Covers the audit log too, but both roles can change your infrastructure, and the service account will then fail Service accounts are not Org Admin by design. Tidal Control does not exempt its own service account from that check.

Granting a read-only compliance tool the ability to modify production is usually the worse trade, which is why Cluster Developer alone is the recommendation until Auditor becomes available to you.

Configuration step-by-step plan

We'll create a service account, generate an API key for it, then add the connection in Tidal Control.

Configuration steps:

1. Create a service account
2. Create an API key
3. Configure the integration in Tidal Control

Step 1: Create a service account

• Sign in to cockroachlabs.cloud and open Access Management
• On the Service Accounts tab, click Create and name the account, for example Tidal Control
• Assign the roles you chose above, at organisation scope

Step 2: Create an API key

• Open the service account you just created
• Click Create API Key
• Copy the secret immediately: it is shown only in that dialog

Step 3: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to CockroachDB Cloud
• Fill in the configuration:
  • Name: A descriptive name, for example CockroachDB Cloud
  • API key: The secret from step 2
• Click "Create" to save the integration

Configuration fields explained

The integration dialog asks for the following values:

Name:

• A descriptive name for this connection
• For example: CockroachDB Cloud, CockroachDB Production

API key:

• The service account API key from step 2
• Required, and stored as a secret
• The key already identifies its organisation, so there is no organisation field to fill in

Verification

The integration is working when all of the following are true:

• Settings → Integrations shows CockroachDB Cloud under Configured Integrations
• CockroachDB tests are available in the Tests section
• Test refresh delivers results without authentication errors

Frequently asked questions

Do I need an organisation ID? No. An API key is scoped to a single CockroachDB Cloud organisation, so the key alone is enough.

Is Org Admin required? No, and it is best avoided. Org Admin is not needed for any endpoint this integration reads, and a service account holding it will fail the check that service accounts are not Org Admin.

Why do the encryption, log export and PrivateLink tests report nothing? Customer-managed encryption keys, log export and PrivateLink endpoint services are Advanced-tier features. On a Basic or Standard cluster those endpoints return no data, and the cluster is recorded as not configured.

Can Tidal Control see the data in my databases? No. The integration reads the Cloud API, which exposes configuration and inventory. It lists database and SQL user names, never table contents.

Common problems

"API Key is required"

• The field is empty, or the copied value was lost. Create a new key on the service account

Audit log test fails with no events

• The service account lacks the Auditor role. Either add it, or accept the failure as documented above

Cluster inventory is empty but other checks work

• The service account is missing Cluster Developer. Add it at organisation scope

Backup, encryption or role grant checks return nothing

• These need Auditor. Without it they cannot read the underlying endpoints

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.