Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time access to a PostgreSQL database — creating a temporary database user with the target role at checkout and dropping it at checkin.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with connectivity to your PostgreSQL instance
Configure checkout and checkin routines from the access-broker-examples repository
Register the PostgreSQL database as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out database access and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to the PostgreSQL instance (port 5432)
A PostgreSQL superuser or a user with CREATEROLE and GRANT OPTION on the target roles
psql available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker runs psql commands to create and drop temporary database users. At checkout, Britive creates a PostgreSQL user derived from the requester’s email, sets a temporary password, and grants the target role. At checkin (or on expiry), the user is dropped — no standing database accounts remain.

User → Britive Console → Access Broker → psql → CREATE ROLE / GRANT ROLE → DROP ROLE

Onboarding the Application

Configure the broker for PostgreSQL access management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under Postgres/permissions/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker with your Britive tenant.

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy Postgres/permissions/ scripts to your broker's scripts directory

Create a PostgreSQL admin user for the broker

CREATE ROLE britive_admin WITH LOGIN PASSWORD 'strong-password' CREATEROLE;
GRANT target_role TO britive_admin WITH ADMIN OPTION;

Store the credentials in the Britive Secrets Store.

Register the PostgreSQL database in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Enter the host, port, database name, and admin user details.

Verify broker connectivity

Confirm the broker can connect to PostgreSQL: psql -h <host> -U britive_admin -d <dbname> -c "\l"

Using Shell

Key environment variables used by the broker scripts:

BRITIVE_USER=user@example.com   # Injected by the broker at checkout
db_host=db.example.com
db_name=myapp
svc_user=britive_admin
svc_password=...                # From Britive Secrets Store
role_name=readonly

Refer to the britive/access-broker-examples Postgres/ directory for the full script set, covering superuser and role-based access variants.

Using Terraform

resource "britive_resource_manager_resource_type" "postgresql" {
  name        = "PostgreSQL"
  description = "PostgreSQL database server"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "port"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "database"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "pg_prod" {
  name          = "postgres-prod"
  resource_type = britive_resource_manager_resource_type.postgresql.name

  parameter_values = {
    hostname = "db.example.com"
    port     = "5432"
    database = "myapp"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Postgres-ReadOnly`)
Expiration	Set a max session duration (e.g., `2h`)

Associate resources

Under Associations, select the PostgreSQL resource.

Add a permission

Under Permissions, select the appropriate checkout/checkin routine (e.g., readonly role, superuser).

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "pg_readonly" {
  name                = "Postgres-ReadOnly"
  expiration_duration = 7200000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "pg_perm" {
  profile_id = britive_resource_manager_profile.pg_readonly.id
  name       = "PostgreSQL-ReadOnly-Access"
  version    = "latest"

  variables {
    name              = "role_name"
    value             = "readonly"
    is_system_defined = false
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out. Britive returns temporary database credentials.

Connect to PostgreSQL

psql -h db.example.com -U <temp-username> -d myapp

Confirm access

SELECT current_user, current_role;

Check in

Return to My Access → click Check In. Attempting to connect with the same credentials should fail with role does not exist.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Broker cannot reach PostgreSQL	Check network connectivity on port 5432 and `pg_hba.conf` rules
`permission denied` on checkout	Admin user lacks `CREATEROLE` or `GRANT OPTION`	Grant required privileges to the `britive_admin` user
User not dropped after checkin	Checkin routine error or active sessions	Terminate active sessions before checkin, or check broker logs

Next Steps

Britive documentation

Last updated on July 8, 2026

Role Grant Access