Requesting PostgreSQL Access

Requesting PostgreSQL access

How to request just-in-time access to PostgreSQL databases through P0 using the CLI.

P0 recommends using the P0 CLI to request access to a PostgreSQL database.

Via the P0 CLI

Prerequisites:

• An installed PostgreSQL P0 integration on the database

• P0 access policies that allow you to request access to the PostgreSQL database

• P0 CLI version 0.25.0 or higher

• An open CloudShell terminal in the database's VPC

  • Open a CloudShell instance by navigating to the database's page within the "RDS" service in the AWS cloud console, then choosing "CloudShell" under "Connectivity & security", then clicking "Launch CloudShell"

Listing requestable fields

You can list requestable instances, roles, and databases by executing:

p0 ls postgres role instance                          # lists instances and clusters
p0 ls postgres role name --instance "${INSTANCE}"     # lists roles
p0 ls postgres role database --instance "${INSTANCE}" # lists databases within an instance 

Making a request

From the CLI, execute:

p0 aws rds generate-db-auth-token --arch postgres --role "${ROLE}" --instance "${INSTANCE}"

where <role> is the name of the role you want to access, and <instance> is the identifier configured in P0 when the instance was installed in P0.

After executing p0 aws rds generate-db-auth-token, P0 will create an access request. Have the request approved. Once it is approved, the command will emit instructions to connect to the instance.

Example:

export RDS_SSL_CA='/certs/global-bundle.pem'
export RDS_HOST=<hostname>
export PGPASSWORD=<password>

psql "host=${RDS_HOST} port=5432 sslmode=verify-full sslrootcert=${RDS_SSL_CA} dbname=postgres user=p0_john_doe"

Copy these instructions.

Now, navigate to the open CloudShell terminal, and execute these instructions. You will receive access to the database.