conntect to RDS Aurora withh less privilege

Question

Hi team,

My app runs on ECS fargate cluster, which connects to MySQL Aurora DB.

Actually, the fargate containers connect to my DB using the root/master RDS account of the DB,

I want to use the least privilege principle so that my fargate task can not do too much other than: select, insert, update and delete.

how can I achieve this architecture where I can pass to fargate only **creds** that allow my app to do only CRUD operation and not stuff like db dump.....

Note: we are not allowed at all to create IAM users in our AWS account

Thank you.

Answer

Since you are not allowed to create IAM users and database IAM authentication (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/database-authentication.html#iam-database-authentication) might not be an option for you, you can use password authentication instead (https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/database-authentication.html#password-authentication).

Using password authentication, you can create users and grant them a less privileged access to your database. If you are using an Aurora MySQL version that is compatible with MySQL 8.0, you can refer to [MySQL 8.0 Reference Manual](https://dev.mysql.com/doc/refman/8.0/en/access-control.html,) for more information.

conntect to RDS Aurora withh less privilege

Relevant content