4 ms·
Ask HN: How many of you open up your production DBs to internal users?
I know all the reasons why this isn't a good idea, but everywhere I've worked, people do it to prevent ad-hoc requests from people who don't have access.
My feeling is that this is a "open secret" that most SMBs do it, but I'm keen to hear:
1. Whether you / your company does it
2. If you avoided it, how did you do that
- keyurishah 2y agowe have opened up in read only mode. new fancy name is "self serve analytics"
- lunarcave 2y agoInteresting. How do the users connect to it? Do they tunnel into it or is there an application that acts as the proxy?
- cebert 2y agoWe can’t do this in the industry I work in. We’re subject to regulatory compliance requirements like SOC2, FedRamp, and CJIS. If an auditor found that access to production databases wasn’t limited on a per-need basis and that access was audited, we’d face significant consequences.
- lunarcave 2y agoFair. But my intuition is that people do it until they get restricted by compliance, after which they seem to invest in a proper setup.
- gregjor 2y agoNo direct access, but we have a custom report builder tool in the (internal) web app that lets users write SQL queries (SELECT only) against a read-only replica of the production database. They can name and save those, even put them in their navigation menu.
- lunarcave 2y agoThanks. And I assume that the web app allows them to do parameterization of ids etc?
- gregjor 2y agoUsers can put placeholders in the query (e.g. :student_id, :year) and then get prompted for those when they run the query. Results page supports filtering and sorting, and saving to CSV/Excel. This wasn't intended as an end-user tool because few users know SQL or the database schema -- a few do. I wrote it because we get a lot of one-off or once-a-quarter requests for reports and CSV for Excel.
- tianzhou 2y agoCheck out Bytebase which handles all human-to-db operations (schema change, ad-hoc change, ad-hoc query). Disclaimer: I am the co-founder.