2

In one of our projects we have hosted our web application on an Amazon Linux AMI instance and it relies on a Amazon RDS MySQL instance as DB server.

One of our client's developer wants to have access to the DB to query the tables and its contents. We do not want to provide an access with which he should be able to change any table contents (inadvertently). We are looking something like PHPMyadmin or SQLWorkbench access, but only in read-only mode.

Adding complexity he works from home and have a broadband with dynamic IP. Hence it seems we cannot grant IP based access as well.

As an alternate idea, we thought of replicating the database on to another server and grant full access to that replicated one so that we can be safe and satisfy the need. But this involves additional cost and the changes will not be replicated immediately.

Any ideas to expose the existing RDS as read-only will be a great advantage and is highly appreciated.

2
  • 1
    From database point of view, granting only SELECT on MySQL tables for a specific user should be enough. – Eric Ly Sep 15 '16 at 15:03
  • assuming you will be having public ip for any one of your AWS host and ssh is enabled (which is having access to your DB server (if its running in separate instance)), create some kind of utility which will trigger the query (query should be configurable, db driver should use specific user(DB) who is having limited permission to connect with the db), writes output to a file/console and place the utility in that server. do login with ssh (user(OS) should have limited access) and can configure the query as you want and execute the utility. – Spike Sep 17 '16 at 10:03
3
+50

Presumably your connection is secured so only your office IP can access the database.

With that in mind a secure VPN tunnel that only directs out to the database area would provide security from them accessing any other systems

And from the database perspective his access rights should be secured down to read-only which will prevent him from modifying anything.

See http://dev.mysql.com/doc/mysql-security-excerpt/5.6/en/adding-users.html for more details on creating users, note the GRANT command, GRANT SELECT will allow them select access, so they cannot update, delete, insert or perform any other such actions.

See http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.html for more details on RDS authentication if that is required

As for VPN that depends on the infrastructure you have setup, speak to your IT Admins about this

2
  • Thanks, VPN is one good solution indeed. I will wait for other answers especially if it does not involve a VPN set up. – Narayanan Sep 13 '16 at 12:20
  • 3
    having a dynamic IP does restrict the options, the VPN to the office or to AWS itself are about your only options without opening up the database access to the world for that user, which of course is not a great idea from a security point of view – Payload Sep 15 '16 at 23:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.