Implementing Just-in-Time (JIT) Access for Production Databases

The principle of Least Privilege states that a user should only have the access necessary to do their job. Most teams interpret this as: “Developers get Read-Only, Admins get Read-Write.”

But this misses the dimension of Time. Does an Admin need Read-Write access while they are sleeping? Does a Developer need Read-Only access to sensitive PII when they are not debugging a ticket?

Just-in-Time (JIT) Access answers “No.”

What is JIT Access?

JIT Access is a workflow where permissions are granted temporarily and on-demand. Instead of “standing access” (permanent), users have “eligible access.”

The JIT Workflow

1. Request: Engineer needs to fix a bug. They request access to Production-DB for 2 hours. They provide a reason: “Investigating Incident #123”.
2. Approval:
   • Manual: A team lead receives a Slack notification and clicks “Approve”.
   • Auto: If the request meets certain criteria (e.g., Read-Only, during business hours), it is auto-approved.
3. Access: The engineer can now query the database via their workbench.
4. Revocation: After 2 hours, the session is killed. Access is gone.

Why Implement JIT?

1. Reduced Blast Radius

If an engineer’s laptop is compromised, the attacker finds… nothing. There are no saved passwords. There is no active session. The attacker cannot request access because they don’t have the MFA/SSO context.

2. Clean Audit Trails

Every access event is tied to a specific business reason.

• Bad Log: “User admin logged in at 2:00 PM.”
• Good Log: “Alice requested access for ‘Ticket #123’ at 2:00 PM. Approved by Bob.”

3. Psychological Safety

Engineers often fear touching production because they might accidentally break something. With JIT, they can request Read-Only access by default, knowing they can’t accidentally run a DELETE. They only request Write access when they absolutely need to run a migration or fix data.

Implementing JIT with VaultSQL

VaultSQL is built around JIT.

• Request Flow: Built-in to the dashboard.
• Time-Bound: All access grants have a TTL (Time To Live).
• Slack Integration: Approvals happen where the team already works.

Conclusion

Permanent access is a relic of the past. It creates unnecessary risk and anxiety. JIT access aligns security with the reality of engineering work: we need access to fix problems, not to hoard permissions.