I have an microservice architecture running on AWS ECS cluster using Postgres and Node and there is this requirement that we need to somehow allow our client to lock our database with a secret key such that we the developer's should not be able to access the DB directly without their consent.

This sounds a bit weird but the project involves sensitive data and there are strict compliance requirements which need to be met and hence we need to allow them in someway by doing something or the other by means of which when my app runs it fetches the credentials from a service and uses them to access the db while i should not be able to do that.

I looked at couple of AWS services which might help me store secret credentials in a safe place such as the Parameter Store and encrypt the data using KMS. But i have no idea that is this thing possible at all using AWS services or by any other means.

Any help or pointers as to how should one go about implementing this idea ?

  • 1
    You need to get that specced out in a lot of detail. Are they providing a key in a request, that you then use to make a call to the database? Then you can just hold onto the key and use it later. It sounds like the requirements need to be thought through more before you get to implementation. Feb 9, 2017 at 16:26

1 Answer 1


It really depends on your requirements as Vinay pointed out. However I can give you some options:

  • You setup an IAM role which allows to change the master password of the RDS instance. Whenever you start the server you set this credential via the application. The AWS account has to be configured in a way that the developers are not able to do that. Issues: You cannot easily access anymore the database instance. You may have some issues with the scaling since you do not want to that two instances changes the password at the same time.

  • You setup the developer users within the AWS account in a way that they are not able to change the password of the RDS instance. The application access an S3 bucket to which the developers do not have access to. However the application can read the data from the S3 bucket. You can do this by using IAM roles which you assign to the application EC2 instances. Within the bucket you store the RDS password. You may allow from within the application to change the password. This way you can setup the whole thing initially and allow the client to change it once (or more). This way you can lock yourself out.

  • Eventually you can setup on the network level with security groups rules which prevents an access from the outside and you prevent that the developers can access the environment. This is eventually problematic since you may need to access the environment since you need a way to maintain the EC2 instances.

  • 1
    thanks for the tips. Will detail the requirements a bit more.
    – Vinay
    Mar 6, 2017 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .