Just-in-Time Database Access

Just-In-Time (JIT) Database Access is a security practice where database access privileges are granted temporarily, only when needed, and automatically revoked after a specified period. The goal is to reduce the risk of unauthorized access, minimize the attack surface, and enhance security by ensuring that users or applications have access only when it is necessary for a specific task.

Traditional workflow

Below shows a typical workflow offered by the existing JIT database access solutions:

1. Incident starts.


2. On-call visits the JIT system to request elevated database permissions.


3. Request is approved, JIT system provisions a temporary database user and give it to the on-call.


4. On-call uses the temporary database user to connect to the production database from a SQL client and starts
   troubleshooting.


5. Incident ends.


6. JIT system revokes the temporary database user or let the user expire automatically.

Although existing JIT solutions provide some degree of automation and centralized control, they are limited by the disconnect between the system used to request and provision JIT database access and the system where end users actually connect to the databases.

1. Users have to set up different database credentials in their SQL client every time.




2. While the system can review and audit JIT access requests, it cannot record or control the SQL queries executed by the end users.

Bytebase workflow

Bytebase provides the similar
EXPLAIN
sql.explain



Query
sql.select



Export
sql.export


Write (subject to
Admin
sql.admin


Request change for review
Create Issue
issues.create