Temporary User Access

Overview

At checkout, the broker creates a temporary MySQL user with ALL privileges on the target database. At checkin, the user is dropped. This pattern grants full database-level access for admin or DBA sessions — use it only when scoped role access is insufficient.

Before You Begin

The broker is running and connected (see Getting Started)
mysql client, aws CLI, and jq are installed on the broker host
The broker service account has CREATE USER, GRANT ALL, and DROP USER privileges

Checkout Routine

Full script: Aurora MySQL/permissions/temp-user/

Environment variables:

Variable	Notes
`user`	Injected — requesting user’s email
`host`	Aurora cluster endpoint
`dburl`	Same as `host`
`secret`	AWS Secrets Manager secret name or ARN

Create temp user with ALL privileges:

Aurora MySQL/permissions/temp-user/checkout.sh

DB_USER=$(echo "$user" | cut -d'@' -f1 | tr -cd '[:alnum:]')
DB_PASSWORD=$(openssl rand -base64 16 | tr -d '=/+')

SECRET_JSON=$(aws secretsmanager get-secret-value --secret-id "$secret" --query SecretString --output text)
ADMIN_USER=$(echo "$SECRET_JSON" | jq -r '.username')
ADMIN_PASS=$(echo "$SECRET_JSON" | jq -r '.password')

mysql -h "$dburl" -u "$ADMIN_USER" -p"$ADMIN_PASS" <<EOF
CREATE USER IF NOT EXISTS '${DB_USER}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
GRANT ALL PRIVILEGES ON systemdb.* TO '${DB_USER}'@'%';
FLUSH PRIVILEGES;
EOF

echo "username=${DB_USER}"
echo "password=${DB_PASSWORD}"
echo "host=${host}"

Checkin Routine

Full script: Aurora MySQL/permissions/temp-user/

Aurora MySQL/permissions/temp-user/checkin.sh

DB_USER=$(echo "$user" | cut -d'@' -f1 | tr -cd '[:alnum:]')

SECRET_JSON=$(aws secretsmanager get-secret-value --secret-id "$secret" --query SecretString --output text)
ADMIN_USER=$(echo "$SECRET_JSON" | jq -r '.username')
ADMIN_PASS=$(echo "$SECRET_JSON" | jq -r '.password')

mysql -h "$dburl" -u "$ADMIN_USER" -p"$ADMIN_PASS" <<EOF
DROP USER IF EXISTS '${DB_USER}'@'%';
FLUSH PRIVILEGES;
EOF

echo "User ${DB_USER} dropped."

This pattern grants ALL PRIVILEGES on the target database — use for admin sessions only. For day-to-day developer or analyst access, use Role-Based Access to limit the privilege to what the user actually needs.

Configure in Britive

Create a response template

Go to Resource Manager → Response Templates → New Template. Add fields for username, password, and host.

Create a permission

Go to Resource Manager → Resource Type Permissions → New Permission. Set Language to Shell.

Paste the checkout and checkin routines. Declare variables:

Variable	System defined	Notes
`user`	Yes	Injected automatically
`host`	No	Set per resource
`dburl`	No	Set per resource
`secret`	No	Set per resource

Under Response Templates, attach the template you created.

Create a profile

Go to Resource Manager → Profiles → New Profile. Set a short expiration (e.g. 2h). Under Associations, select the resource label(s). Under Permissions, add this permission.

Add a policy with approval

Under Policies, assign members and add an approval condition — this pattern grants full database access and should require manager or DBA team approval.

aurora-mysql-temp-user.tf

# Response template
resource "britive_resource_manager_response_template" "mysql_creds" {
name                     = "MySQL-TempUser-Credentials"
description              = "Returns MySQL credentials on checkout"
show_on_ui               = true
is_console_access_enabled = false
template_data            = "Host: {{host}}\nUsername: {{username}}\nPassword: {{password}}"
}

# Resource type (shared with role-access pattern if already created)
resource "britive_resource_manager_resource_type" "aurora" {
name        = "AuroraMySQLCluster"
description = "Amazon Aurora MySQL cluster"

parameters {
  param_name   = "dburl"
  param_type   = "string"
  is_mandatory = true
}
parameters {
  param_name   = "host"
  param_type   = "string"
  is_mandatory = true
}
parameters {
  param_name   = "secret"
  param_type   = "string"
  is_mandatory = true
}
}

# Permission — temp user checkout/checkin
resource "britive_resource_manager_resource_type_permission" "aurora_temp" {
name             = "Aurora-MySQL-TempUser"
resource_type_id = britive_resource_manager_resource_type.aurora.id
description      = "JIT MySQL user with ALL privileges on target database"
code_language    = "Shell"

checkout_code_file = "${path.module}/scripts/temp-user/checkout.sh"
checkin_code_file  = "${path.module}/scripts/temp-user/checkin.sh"

variables          = ["user", "host", "dburl", "secret"]
response_templates = [britive_resource_manager_response_template.mysql_creds.name]
}

# Profile — JIT full MySQL access
resource "britive_resource_manager_profile" "aurora_temp" {
name                = "Aurora-MySQL-TempUser"
description         = "JIT full database access via temporary MySQL user"
expiration_duration = 7200000   # 2 hours in milliseconds

associations {
  label_key = "environment"
  values    = ["Production"]
}
}

# Profile permission
resource "britive_resource_manager_profile_permission" "aurora_temp" {
profile_id = britive_resource_manager_profile.aurora_temp.id
name       = britive_resource_manager_resource_type_permission.aurora_temp.name
version    = "latest"
}

# Profile policy — with approval for ALL privileges
resource "britive_resource_manager_profile_policy" "aurora_temp" {
profile_id  = britive_resource_manager_profile.aurora_temp.id
policy_name = "Aurora-MySQL-TempUser-Policy"

members = jsonencode({
  tags             = [{ name = "dba-team" }]
  users            = []
  serviceIdentities = []
  aiIdentities     = []
})

condition = jsonencode({
  approval = {
    approvers          = { tags = ["dba-managers"], userIds = [] }
    notificationMedium = ["Email"]
    timeToApprove      = 30
    validFor           = 120
    isValidForInDays   = false
  }
  ipAddress    = null
  timeOfAccess = null
})

access_type = "Allow"
consumer    = "resourceprofile"
is_active   = true
is_draft    = false
}

Verify

Check out the profile

Navigate to My Access → find the profile → Check Out. Credentials appear in the response.

Connect and verify access

mysql -h <host> -u <username> -p<password> systemdb

SELECT current_user();
SHOW GRANTS;
-- Expected: GRANT ALL PRIVILEGES ON systemdb.* TO 'username'@'%'

Check in

Return to My Access → Check In.

Confirm the user is dropped

mysql -h <host> -u <username> -p<password> systemdb
# Expected: ERROR 1045 (28000): Access denied

Troubleshoot

Symptom	Cause	Fix
`GRANT ALL failed`	`britive_svc` lacks `GRANT OPTION`	Add `WITH GRANT OPTION` to the service account’s grants
User still exists after checkin	Active connection held the session	Kill the session manually: `KILL CONNECTION <id>;`, then retry checkin
`Access denied` on Secrets Manager	IAM role missing permission	Attach `secretsmanager:GetSecretValue` to the broker instance profile

Last updated on July 8, 2026

Role-Based Access