TiDB supports multiple layers of security: TLS for client and inter-component communication, MySQL-compatible user authentication and privileges, Role-Based Access Control (RBAC), Security Enhanced Mode (SEM), and encryption at rest via TiKV.
TLS for client connections
Configure TLS in tidb.toml under the [security] section. The following options are drawn from config.toml.example:
With auto-tls = true, TiDB generates a self-signed certificate on startup. For production, provide your own CA-signed certificates.
TLS for inter-component communication
Secure communication between TiDB, TiKV, PD, and TiFlash uses separate certificates:
User authentication
TiDB uses MySQL-compatible user accounts and the mysql.user system table. Create users and assign passwords with standard SQL:
Privilege management (RBAC)
TiDB implements MySQL-compatible privilege levels: global, database, table, and column.
Roles
Use roles to group privileges and assign them to multiple users:
Security Enhanced Mode (SEM)
SEM restricts the SUPER privilege and requires fine-grained privileges instead. This limits the blast radius of a compromised superuser account.
Enable SEM in tidb.toml:
Enabling SEM changes privilege requirements for several administrative operations. Test in a non-production environment before enabling in production.
SUPER (such as reading INFORMATION_SCHEMA internal tables) require specific restricted privileges. Use SHOW GRANTS to identify what is needed for each operation.
Encryption at rest
TiKV supports encryption at rest for data files. Configure it in the TiKV configuration file:
TiDB also supports encrypting spilled temporary data files. Configure this in tidb.toml:
Connecting with TLS as a client
To require TLS for a specific user:
