Automate AWS RDS User Management

Fun Learn 0
Viewed 20

Most of you would have encountered the problem of creating db users for developers across multiple database (using common user is not allowed). We have around 90 DB's on AWS and 200-250 dev's. Everyday someone needs access to a database and this is manual and repetitive task.

I am looking for a solution to automate end-to-end lifecycle of user management, scripting or creating a terraform module are solutions which I already have in my mind, but how does other organization manage DB users at scale ?

I did look at AWS IAM authentication but I am not sure how can we grant fine grain access using IAM roles.

Cheers, Fun Learn

terraform amazon-web-services database
1 Answers

The way I've done this is (high level);

  • Create your RDS Terraform Config / Module(s)
  • Create a sql file with the user & grant creations needed
  • Create a wrapper script that deploys terraform then connects to it to deploy your SQL file with user creation
  • Your wrapper script will need to use Terraform Outputs to get your newly created RDS Endpoint to connect to | Say you created an output called rds_endpoint in your terraform plan / config... This is how you grab it in bash terraform output rds_endpoint
  • Assuming your new RDS DB is not publicly accessible, your wrapper script will need to tunnel in through a bastion or some other instance that is publicly accessible with access to the DB. Example: ssh -oStrictHostKeyChecking=no -p 22 -i ~/.ssh/bastion-host-key.pem -C -N ec2-user@$bastion_ip -L 3306:$rds_endpoint:3306 &
  • Your wrapper script will need to use the RDS user & password you created with terraform as well to run the SQL File
paulg0
Related