DBA Access

Overview

At checkout the broker creates a temporary user with management privileges — ALL PRIVILEGES ON DATABASE, plus the pg_monitor and pg_signal_backend roles — so an operator can inspect server internals and terminate sessions without full superuser access. At checkin the user and its privileges are removed. Service account credentials are pulled from AWS Secrets Manager, not passed as plain environment variables.

Before You Begin

The Access Broker is deployed and connected
psql, AWS CLI, jq, and openssl on the broker host
A service account with CREATEROLE and GRANT OPTION on the delegated privileges
Service credentials stored in AWS Secrets Manager; the broker host able to read that secret

Environment Variables

Variable	Notes
`BRITIVE_USER`	Injected — email; username derived (non-alphanumerics → underscores)
`SECRET_NAME`	AWS Secrets Manager secret holding service credentials
`DB_NAME`	Target database

Checkout / Checkin

Full scripts: grant_dba_access.sh · revoke_dba_access.sh

Postgres/permissions/dba-access/grant_dba_access.sh

# pull service creds from Secrets Manager
CREDS=$(aws secretsmanager get-secret-value --secret-id "$SECRET_NAME" --query SecretString --output text)

# create user, grant management privileges
psql ... <<SQL
CREATE USER "$username" PASSWORD '$generated';
GRANT ALL PRIVILEGES ON DATABASE "$DB_NAME" TO "$username";
GRANT pg_monitor, pg_signal_backend TO "$username";
SQL

Checkin reassigns/drops owned objects before dropping the role:

REASSIGN OWNED BY "<user>" TO "<svc_user>";
DROP OWNED BY "<user>";
DROP ROLE "<user>";

Configure in Britive

Create the permission

Resource Manager → Resource Type Permissions → New Permission. Language = Shell. Paste both scripts. Declare SECRET_NAME, DB_NAME (BRITIVE_USER is system-defined).

Create a profile and policy

Create a profile (e.g. 2h), add the permission, and add a policy with approval. The checkout output is a pgAdmin/DBeaver-ready connection JSON.

Verify

-- during checkout
\du <user>     -- shows membership in pg_monitor / pg_signal_backend
-- after checkin
\du <user>     -- role no longer exists

Troubleshoot

Symptom	Cause	Fix
`AccessDenied` reading secret	Broker host IAM can’t read the secret	Grant `secretsmanager:GetSecretValue` on `SECRET_NAME`
`DROP ROLE` fails at checkin	User owns objects	Handled by `REASSIGN/DROP OWNED`; confirm the checkin routine ran fully
`permission denied to create role`	Service account lacks `CREATEROLE`	Grant `CREATEROLE` to the service account

Next Steps

Last updated on July 8, 2026

Role Grant Access Superuser Access