Ask HN: How many of you open up your production DBs to internal users? | Hacker News Reader

Ask HN: How many of you open up your production DBs to internal users?

1 pointlunarcave8 comments

I know all the reasons why this isn't a good idea, but everywhere I've worked, people do it to prevent ad-hoc requests from people who don't have access.

My feeling is that this is a "open secret" that most SMBs do it, but I'm keen to hear:

1. Whether you / your company does it 2. If you avoided it, how did you do that

View on HN

We can’t do this in the industry I work in. We’re subject to regulatory compliance requirements like SOC2, FedRamp, and CJIS. If an auditor found that access to production databases wasn’t limited on a per-need basis and that access was audited, we’d face significant consequences.

Fair. But my intuition is that people do it until they get restricted by compliance, after which they seem to invest in a proper setup.

No direct access, but we have a custom report builder tool in the (internal) web app that lets users write SQL queries (SELECT only) against a read-only replica of the production database. They can name and save those, even put them in their navigation menu.

Thanks. And I assume that the web app allows them to do parameterization of ids etc?

Users can put placeholders in the query (e.g. :student_id, :year) and then get prompted for those when they run the query. Results page supports filtering and sorting, and saving to CSV/Excel.

This wasn't intended as an end-user tool because few users know SQL or the database schema -- a few do. I wrote it because we get a lot of one-off or once-a-quarter requests for reports and CSV for Excel.

Check out Bytebase which handles all human-to-db operations (schema change, ad-hoc change, ad-hoc query). Disclaimer: I am the co-founder.

we have opened up in read only mode. new fancy name is "self serve analytics"

Interesting. How do the users connect to it? Do they tunnel into it or is there an application that acts as the proxy?

Reply on news.ycombinator.com