4 ms·
>But it’s almost impossible to build a “monolith” database that lives up to the modern legislation requirements, at least within the EU. So we’re basically livi
by fauigerzigerk 3y ago
>But it’s almost impossible to build a “monolith” database that lives up to the modern legislation requirements, at least within the EU. So we’re basically living in a world where the way we’ve done databases for the past 50 years, doesn’t work for the business.
Not sure I agree. It seems far simpler to comply with most regulations if you store your data in a centralised data store with good management features.
If each and every microservice handles its own data, how would you implement rules affecting all of them, such as retention periods, deletion requests, permissions, access logs, etc? It's not just that the data is stored all over the place. You may also have to use microservice specific APIs to access it.
If you're referring to laws that require data storage in a particular jurisdiction, it would still be easier to centralise data management in each jursdiction rather than distribute it across scores of services within each of those jurisdictions.
- robertlagrant 3y agoI think the idea is e.g. you can just have opaque keys (e.g. UUIDs) to a person in all services except one, which has their name in. Destroying that record in one place pseud/anonymisises the record across the system.
- TheNewsIsHere 3y agoThis is a fairly standard approach to solving that issue. There are even some applications built for the purpose of housing that data, encrypting it, maintaining audit and use records, processing DSARs, and interacting with the data in useful ways via API.
- devjab 3y ago> Not sure I agree. It seems far simpler to comply with most regulations if you store your data in a centralised data store with good management features. I don't think we disagree, it's just that we soon won't be allowed to physically store our data on the same servers because the EU deems it too risky. A couple of years ago you could operate 600 energy plants from the same few servers, but by January 2024 that will no longer be legal. Aside from that, we're now entering a world where you need to do comply with regular audits on data field levels as well as an explosion of access roles. I'm not sure how you would manage that in a traditional centralized data store, you probably could, but we do it with OPA and once you do that, there is no difference between using a monolith or micro services because it all goes through the central policies. You could argue that the energy sector is a bit of a special case, but it's even sticter in anything related to the financial sectors.