How to request just-in-time access to an RDS Postgres database with P0
A quick walkthrough of how P0 grants temporary least privilege access to an RDS Postgres database. You’ll see the full flow from denied login to a successful connection with short-lived credentials tied to your identity.
]===============================================
Hi, in this video I’m going to walk through how to use P0 to get just-in-time access to an RDS Postgres database.
I’ll start by trying a couple of commands I already had in my terminal. They attempt to log me into the database. As you can see, I get a password authentication failure because I have no standing access of any kind. This is a database where I only get in if I explicitly request permission.
So I’ll switch over to P0. In the P0 console, I’ll click Request access. I’ll select Postgres, choose role for my access type, then pick the specific role I want. In this case it’s stats reader.
I’ll add a reason. I’ll say I’m diagnosing slow queries. Then I’ll choose how long I need access. An hour should be enough, so I’ll request that.
Normally this request would route to a manager or the owner of the database. That all depends on the routing rules you set up in P0. For this demo I can approve my own request, so I’ll do that here. The approver can shorten or extend the duration if they want, but I’ll leave it at the hour I originally requested. And you can see the request is now approved.
Now I’ll switch back to my console. At this point it depends a little on your AWS login setup, but in most cases you run some variant of aws configure. In my case I ran aws configure sso earlier, so I already have a profile I can use. I’ll add that profile to the command that sets my Postgres password, and then I’ll try the database connection again.
I’ve added the database name at the end so I connect to the right one. This time the connection succeeds. Before I kept getting the password error. Now I’m in.
I can run a command to show my tables and row counts. I only have one table here and it doesn’t have any data. And the reason I can run this is that the stats reader role has access to the PG stat tables.
If I try to read the actual table with customer data, I get a permission denied error. That’s expected. It’s outside the role I requested from P0. I only have the permissions I explicitly asked for.
One last thing. If I select my current user, you’ll see it’s my own identity. If you have session recording or other auditing enabled, every action ties back to my user rather than to any shared credential.
So what we’ve shown is that with P0 you can start with zero standing access, make a least privilege request, get only the permissions you need, and connect without any static or shared credentials.