Zero trust is often reduced to marketing language, but NIST SP 800-207 defines it precisely: never grant access based on location or prior authentication alone. Applied to cloud databases, it breaks into four concrete pillars. Identity verification uses short-lived tokens, mTLS with X.509 certificates, JWT authentication, cloud IAM integration, workload identity, and enforced MFA. Access control requires both portal RBAC and database RBAC, row-level security, and just-in-time privileged access via Okta. Network restriction relies on AWS PrivateLink, Azure Private Link, and GCP Private Service Connect to keep traffic off the public internet. Data protection uses AES-256 encryption at rest (with optional customer-managed keys via CMEK), TLS 1.2+ in transit, and mTLS at the transport layer. A set of pointed questions is provided to help distinguish genuine zero-trust architecture from vendor branding.
Sort: