Securing Deployment

It is important that we secure all aspects of WSO2 Private PaaS against security threats. This page explains how the topics in the message broker can be secured. In the future, we will discuss how the other aspects of WSO2 Private PaaS can be secured as well.

Securing message broker topics

Message broker topics can be secured by creating message broker users and user roles and granting permissions accordingly.

To secure the topics in ActiveMQ:

Create users for each topic publisher and subscriber.
For example, create users for cloud-controller, stratos-manager, cartridge-agent, load-balancer, etc.
Create user roles granting write/read access to the topics.
For example, create the following user roles: topology-write, topology-read, instance-notifier-write, instance-notifier-read, instance-status-write, instance-status-read, etc.
Add the relevant user roles to the users you created.
When sending the Cartridge Agent's user credentials to the cartridge instance, encrypt the password and add it in the payload.
Each WSO2 Private PaaS product configuration needs to use Carbon Secure Wallet and encrypt the user passwords.

In this model, even if an attacker gets access to a WSO2 Private PaaS node or cartridge instance, the attacker might not be able to access the message broker topic unless the user credentials are unleashed. For more ActiveMQ security configuration details, go to Apache ActiveMQ Security.