Databases

Native and browser, for MySQL, PostgreSQL, CockroachDB, SQL Server, Redis, MongoDB, Cassandra, and Oracle beta. In browser mode the built-in SQL client opens automatically. See How users connect, the database options, and query filtering.

Create a PostgreSQL user with bsh

Configure the common bsh settings and these permission variables. The example creates a temporary login and grants an existing database role named app_ro:

BSH_TARGET_HOST=db.example.com
BSH_TARGET_PORT=5432
BSH_TRANSPORT_USER=britive_admin
BSH_TRANSPORT_PASSWORD_FILE=/run/secrets/database-admin-password
BSH_DB_TLS_MODE=verify-full
BSH_TRANSPORT_CA_CERT_PATH=/run/certs/database-ca.pem
BSH_TARGET_DATABASE=analytics
BSH_TARGET_TLS=true
BSH_TARGET_CA_CERT=file:///run/certs/database-ca.pem
BSH_ROLES=app_ro

The administrative account needs permission to create logins and grant app_ro. The administrative CA setting verifies bsh’s connection. BSH_TARGET_CA_CERT verifies Bridge’s separate connection to the target.

#!/bin/sh
exec bsh checkout postgres --method temp-user --mode bridge

#!/bin/sh
exec bsh checkin postgres --method temp-user --mode bridge

bsh selects the database transport and engine automatically. Checkin drops the created login by default. Use rotate-password with BSH_SHARED_ACCOUNT to rotate an existing account instead. That method changes the password again at checkin and can affect other users of the account.

Select another engine

The same command pattern supports the protocols below. SQL methods accept BSH_ROLES or BSH_GRANTS. Redis and MongoDB require store-specific BSH_GRANTS; Cassandra accepts roles or keyspace grants. Configure the engine’s method settings before changing the protocol. NoSQL methods use the datastore transport.

Set BSH_TARGET_PORT for the target service. The API field target_database has these meanings:

For an Oracle TCPS target, set target_port to its TLS listener, commonly 2484, and supply target_ca_cert for a private CA. The Bridge native listener remains on 1521 by default.

• Native - point the client above at the Bridge’s port for that engine; the picker shows the exact command.
• Browser - the in-page SQL client via Connect.

mongosh "mongodb://alice%25db.internal:<bridge_auth_password>@bridge.example.com:27017/appdb"