Getting Started

Overview

This guide prepares the Britive Access Broker to manage JIT access to an Amazon Aurora MySQL cluster. The broker uses the mysql client to create and drop temporary database users. Admin credentials are stored in AWS Secrets Manager and retrieved at runtime — never stored on the broker host.

Before You Begin

A running Britive Access Broker on a Linux host with outbound access to:
- The Aurora cluster endpoint (port 3306)
- AWS Secrets Manager (HTTPS)
AWS CLI v2 installed on the broker host
mysql client (version 8+) installed on the broker host
jq installed on the broker host
An IAM role or credentials on the broker host with secretsmanager:GetSecretValue permission
A broker pool token from Resource Manager → Broker Pools → New Pool in the Britive console

Step 1 — Install Dependencies on the Broker Host

# MySQL client — Debian/Ubuntu
sudo apt-get install -y mysql-client jq

# MySQL client — RHEL/Amazon Linux
sudo dnf install -y mysql jq

# AWS CLI v2
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip && sudo ./aws/install

# Verify
mysql --version && aws --version && jq --version

Step 2 — Create the Broker Service Account in Aurora

Connect to the Aurora cluster as an admin user and create a dedicated broker service account:

CREATE USER 'britive_svc'@'%' IDENTIFIED BY 'strong-random-password';

-- Minimum permissions for the role-based access pattern
GRANT CREATE USER ON *.* TO 'britive_svc'@'%';
GRANT SELECT ON mysql.user TO 'britive_svc'@'%';

-- Grant the ability to grant/revoke privileges on managed tables
GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'britive_svc'@'%' WITH GRANT OPTION;

FLUSH PRIVILEGES;

Use a strong, randomly generated password. Store it in AWS Secrets Manager immediately — do not leave it in plaintext anywhere on the broker host.

Step 3 — Store Credentials in AWS Secrets Manager

aws secretsmanager create-secret \
  --name "britive/aurora-mysql/svc-credentials" \
  --description "Britive broker service account for Aurora MySQL" \
  --secret-string '{"username":"britive_svc","password":"strong-random-password"}' \
  --region us-east-1

Note the Secret ARN — you will reference this as the secret variable in the broker permission scripts.

Step 4 — Register the Aurora Cluster as a Resource

Create a resource type

In the Britive console, go to Resource Manager → Resource Types → New Resource Type. Name it AuroraMySQLCluster.

Add parameters:

Parameter	Type	Required
`dburl`	string	Yes
`host`	string	Yes
`secret`	string	Yes

Register the resource

Go to Resource Manager → Resources → New Resource. Select AuroraMySQLCluster.

Set parameter values:

Parameter	Value
`dburl`	Aurora cluster endpoint (e.g. `cluster.cluster-xxx.us-east-1.rds.amazonaws.com`)
`host`	Same as `dburl` (used separately in some scripts)
`secret`	The AWS Secrets Manager secret name or ARN

Assign a broker pool

Under Broker Pools, select the pool containing the broker that can reach the Aurora endpoint and Secrets Manager.

Verify

Confirm the broker host can connect to the cluster using the service account:

# Retrieve credentials from Secrets Manager
SECRET=$(aws secretsmanager get-secret-value \
  --secret-id "britive/aurora-mysql/svc-credentials" \
  --query SecretString --output text)

SVC_USER=$(echo $SECRET | jq -r '.username')
SVC_PASS=$(echo $SECRET | jq -r '.password')

# Test connectivity
mysql -h cluster.cluster-xxx.us-east-1.rds.amazonaws.com \
  -u "$SVC_USER" -p"$SVC_PASS" -e "SELECT current_user();"

A successful current_user() response confirms end-to-end connectivity.

Troubleshoot

Symptom	Cause	Fix
`ERROR 1045 (28000): Access denied`	Wrong credentials or host restriction	Verify the user was created with `'%'` host wildcard and correct password
`ERROR 2003: Can't connect to MySQL server`	Network unreachable	Check security group inbound rules — allow the broker’s IP on port 3306
`Unable to locate credentials` (AWS CLI)	Broker host has no IAM role or credentials	Attach an IAM instance profile with `secretsmanager:GetSecretValue` to the broker EC2 instance
`jq: command not found`	`jq` not installed	`sudo apt-get install jq` or `sudo dnf install jq`

Last updated on May 6, 2026

Role-Based Access