You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/docs/tutorials/just-in-time-database-access-amazon-aurora.md
+55-37Lines changed: 55 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,54 +1,69 @@
1
1
---
2
-
title: 'Just-in-time database access to Amazon Aurora using Bytebase'
2
+
title: 'Just-in-time Database Access to Amazon Aurora using Bytebase'
3
3
author: Ningjing
4
4
tags: Tutorial
5
5
updated_at: 2025/01/07 18:15
6
6
integrations: General
7
-
level: Beginner
7
+
level: Advanced
8
8
estimated_time: '40 mins'
9
9
description: 'In this tutorial, we will demonstrate how to set up Just-in-Time (JIT) access using the Bytebase GUI connecting to Amazon Aurora.'
10
10
---
11
11
12
-
In modern database management, when an incident occurs, developers often need quick access to production databases to troubleshoot and resolve the issue. However, traditional methods, such as using static passwords, can pose security risks and complicate management. For Amazon Aurora, AWS IAM authentication provides a solution by enabling temporary, secure access without the need for password rotation.
12
+
In modern database management, when an incident occurs, developers often need quick access to production databases to troubleshoot and resolve the issue. However, traditional methods, such as using static passwords, can pose security risks and complicate management.
13
13
14
-
But there’s a more flexible and professional approach to manage database access while maintaining robust security: Bytebase.
14
+
## AWS IAM Auth
15
15
16
-
Bytebase is a modern, web-based database management tool that simplifies the database administration process. By offering a user-friendly interface, Bytebase makes managing complex database environments—both on AWS and beyond—easy and professional. It supports a wide range of databases and enables granular control over access permissions.
16
+
For Amazon Aurora and RDS, AWS IAM authentication provides a solution by enabling temporary, secure access without the need for password rotation. With IAM Auth:
17
17
18
-
In this post, we demonstrate how to configure Just-in-Time (JIT) access to Amazon Aurora via Bytebase, allowing developers to quickly connect and troubleshoot production databases in a secure and efficient way. We’ll walk you through the steps to set up AWS IAM authentication in Bytebase, giving you both flexibility and security when managing access to your Aurora databases.
18
+
-**Short-lived tokens**: Instead of using a static password, a temporary authentication token is generated via AWS SDK or CLI. These tokens are time-limited (by default, valid for 15 minutes).
19
19
20
-
By the end of this guide, you'll understand how to streamline access management in Bytebase while maintaining high security and flexibility.
20
+
-**Centralized identity**: Access is controlled via IAM policies rather than within the DB itself, letting you use fine-grained IAM policies and leverage AWS’s centralized identity management.
21
21
22
-
## Solution Overview
22
+
-**Eliminates hard-coded passwords**: No more storing long-lived passwords in configuration files or environment variables. You simply request a token when you need to connect.
23
+
24
+
### Limitation
25
+
26
+
There are still limitations with AWS IAM Auth:
27
+
28
+
-**Limited DB Engine Support**: Only MySQL, PostgreSQL, and Amazon Aurora (MySQL/PostgreSQL-compatible) support IAM auth. Other RDS engines (e.g., SQL Server, Oracle, MariaDB) do not.
23
29
24
-
The following diagram illustrates the configuration of Bytebase connecting to Amazon Aurora MySQL.
30
+
-**Separate DB-Level User Management**: IAM can control who can connect, but once connected, the user’s DB privileges are still governed by database grants (e.g., `GRANT SELECT ON …`). You can’t manage fine-grained table-level permissions solely through IAM.
-**Auditing & Visibility Trade-Offs**: If you opt for one shared database user for everyone, you lose per-user audit trails inside the DB. Creating one DB user per developer (and possibly per IAM identity) can be cumbersome. You do get detailed auditing but at the cost of more management complexity.
27
33
28
-
1. Install Bytebase via Docker in an EC2 instance.
29
-
1. Use Amazon Aurora PostgreSQL as the metadata database.
30
-
1. Connect to Amazon Aurora MySQL via AWS IAM authentication.
34
+
-**Complexity with Large Teams & Enterprise Integrations**: AWS SSO/Identity Center integration simplifies IAM user management, but you still need a strategy for mapping many developers to DB users (shared vs. individual). For large teams, mapping roles/groups to DB users can become complex.
31
35
32
-
### Why use AWS IAM authentication over password authentication?
36
+
##Bytebase
33
37
34
-
While adding connection to Aurora MySQL, Bytebase provides both password and AWS IAM authentication.
38
+
Bytebase is an open-source database DevSecOps solution that complements AWS IAM Auth:
35
39
36
-
1.**Stronger Security**: Uses temporary tokens instead of static passwords, eliminating storage and rotation risks.
37
-
1.**Simplified Management**: Centralized control through IAM, with dynamic permissions and seamless AWS service integration.
38
-
1.**Scalability**: Ideal for cloud-native and multi-region deployments.
39
-
1.**Compliance**: Provides granular control and audit logs via CloudTrail.
40
+
-**More DB Engine Support**: Bytebase supports MySQL, Postgres, Amazon Aurora as well as other RDS engines (e.g., SQL Server, Oracle, MariaDB).
40
41
41
-
### Why use Bytebase over granting AWS IAM user access to Aurora MySQL directly?
42
+
-**Fine-Grained Access via Bytebase**: Even if you opt for a shared DB user in Aurora/RDS (e.g. db_iam_dev_user), Bytebase maintains its own user/role model. Each developer logs into Bytebase with their individual identity (integrated with SSO). You can grant database permission at the table level.
43
+
44
+
-**Auditing at the Platform Level**: Bytebase tracks exactly which user performed which action, even if the database sees only one shared DB user. This gives you per-user audit trails without the overhead of creating separate Aurora/RDS DB users or separate IAM policies per developer.
45
+
46
+
## Solution Overview
42
47
43
-
Then you may ask, provided that AWS IAM can manage access to Aurora MySQL, why bother using Bytebase?
48
+
The diagram below shows how Bytebase integrates with IAM Auth to enable Just-in-Time (JIT) end-user access to Amazon Aurora.
44
49
45
-
1.**Simplified Management**: Bytebase provides a web-based GUI for database management, making it user-friendly, professional, and easy to navigate.
46
-
1.**Flexible Access Control**: AWS IAM user access to Aurora MySQL typically involves granting full control over the database. Bytebase, on the other hand, allows you to grant fine-grained access—specific permissions for databases, tables, and even with expiration times—offering much greater flexibility.
47
-
1.**Support for Multiple Database Types**: Bytebase supports a wide range of databases, both within AWS and beyond, making it a versatile solution for diverse database environments.
- Bytebase itself can run under an IAM role that can connect to Aurora/RDS using the shared IAM-based user.
53
+
54
+
-**Developers authenticate to Bytebase** with their corporate IdP (via SSO). Developers don’t need to see or store any DB credentials.Each developer’s actions are tracked individually in Bytebase.
55
+
56
+
In this model, you don’t have discrete DB users or discrete IAM policies per developer. Bytebase is the gatekeeper, and the real DB connection still use the shared IAM-based user.
57
+
58
+
Below is a brief walkthrough of the setup:
59
+
60
+
1. Install Bytebase using Docker on an EC2 instance.
61
+
1. Configure Bytebase to connect to your Amazon Aurora MySQL database (Bytebase also supports other RDS engines).
62
+
1. Developer requests Just-in-Time (JIT) table-level access with an expiration time directly through Bytebase.
48
63
49
64
## Prerequisites
50
65
51
-
Before starting this tutorial, you will need:
66
+
For this walkthrough, you need the following:
52
67
53
68
- An AWS account
54
69
- An AWS Identity and Access Management (IAM) user with permissions to connect to Amazon Aurora
@@ -62,7 +77,7 @@ Before starting this tutorial, you will need:
62
77
63
78
While creating Aurora MySQL instance, you need to enable AWS IAM authentication.
1. By default, the `(workspace) admin` has the full access to the database. Click **IAM&Admin > Users&Groups** on the left bar, and then click **Add user**.
132
147
133
148
1. Create a user `dev` with the role `Project Developer`. This project-level role will be applied to all projects automatically.
134
149
135
-
1. Log in as the user `dev`, click **Select Project** on the top sidebar, and choose `Aurora MySQL Project`
150
+
1. Log in as the user `dev`, click **Select Project** on the top sidebar, and choose `Aurora MySQL Project`
136
151
1. Click **Database > Databases** on the left bar, you should see two database `employee`.
137
152
1. Click **SQL Editor** on the top bar, connecting to the `employee` database is impossible. Because it's **Community Plan**.
138
153
139
-
### Step 2 - Admin assign you access to the production database (Community and Pro Plan)
154
+
### Admin assigns developer access to the database (Community and Pro Plan)
140
155
141
-
In Bytebase **Community** and **Pro Plan**, the Admin/DBA can assign developer access to the production database.
156
+
In Bytebase **Community** and **Pro Plan**, the Admin/DBA can assign developer access to the database.
142
157
143
158
1. Login as the `admin` user, go into `Aurora MySQL Project`, click **Manage > Members** on the left sidebar.
144
159
@@ -150,7 +165,7 @@ In Bytebase **Community** and **Pro Plan**, the Admin/DBA can assign developer a
### Step 3 - Request JIT access to the production database (Enterprise Plan)
168
+
### Developer requests JIT access to the database (Enterprise Plan)
154
169
155
170
In Bytebase **Enterprise Plan**, you can request a JIT access to the production database.
156
171
@@ -194,6 +209,9 @@ In Bytebase **Enterprise Plan**, you can request a JIT access to the production
194
209
195
210
## Conclusion
196
211
197
-
In this tutorial, we demonstrated how to set up Just-in-Time (JIT) access using the Bytebase GUI connecting to Amazon Aurora MySQL. We also discussed the benefits of using AWS IAM authentication over password authentication and how Bytebase can provide a more flexible and professional approach to managing database access while maintaining robust security.
212
+
In this walkthrough, we explored both the benefits and limitations of using AWS IAM authentication, and demonstrated how Bytebase can complement AWS IAM Auth.
213
+
214
+
By layering Bytebase on top of AWS IAM, you can achieve a passwordless, self-service JIT database access solution that provides fine-grained access control and per-user auditing—without the complexity of managing numerous users or roles at the database
215
+
instance level.
198
216
199
-
By following these steps, you can streamline access management in Bytebase while maintaining high security and flexibility.
217
+
Additionally, you can leverage [Bytebase's API](https://api.bytebase.com/) to further automate the process and integrate with other tools such as Slack.
0 commit comments