Thanks. I've previously worked in technology in the financial services industry so a lot of the ideas for auditing/compliance come from meeting the expectations of that market. Our logic is that if it's seamless enough for them to use it and satisfies their compliance requirements, it should be good for most other industries as well.

Regarding SSH, it has the advantage that you can (and should!) have multiple authorized keys for the same account. For example for the bastion host to connect to our VPC of servers we use individual SSH keys tied to the same proxy account. Databases generally don't allow that type of access.

Some allow using client certificates to login (which nobody uses). Some allow integration with external LDAP/AD (which very few use). The vast majority uses standard username/password based authentication that hopefully is going over SSL (seriously go and check ... for most DBs by default it's sent over plaintext).

Some places try to have per user database accounts (possible tied to AD/LDAP) but that usually devolves to the same app password sharing as the privileges aren't kept in sync or it's just too much of a pain to provision vs just giving someone the app password.

I couldn't agree more; client certs are too much work and come at a non-trivial maintenance cost, same goes for AD/LDAP. So JackDB also acts as authentication provisioning front-end for a DBMS so users don't have to do that themselves and suffer the maintenance cost/overhead. Interesting.

I'm curious, your VPC bastion; how do you make managing SSH keys scalable given that setup? And why not separate accounts which in fact help with keeping sane logs of who did what, and distribute the risk of compromise across several accounts?

> So JackDB also acts as authentication provisioning front-end for a DBMS so users don't have to do that themselves and suffer the maintenance cost/overhead.

Yep. Couple of mouse clicks and a user no longer has access to one or more data sources (grants are role based). Similar effort for provisioning new users.

If the level of effort for a secure system is on par with emailing a password to a co-worker then people will actually use it. Plus with JackDB nobody other than the system admin even has the DB passwords so a normal user can't even send an email out if they wanted to.

> I'm curious, your VPC bastion; how do you make managing SSH keys scalable given that setup? And why not separate accounts which in fact help with keeping sane logs of who did what, and distribute the risk of compromise across several accounts?

At the moment things work for us as we're a very small team. Obviously something more scalable would be needed once you have a large number of people involved. The single proxy account is for convenience. That way the SSH keys to log into the other servers (accessible only through the bastion) can be shared. All servers (bastion included) log the public keys used to connect so we do have a trail of who/what/when. It would just be a bit more involved to filter it. Given our relatively small size it feels like a good tradeoff of security and convenience.

As we grow it's definitely something to (repeatedly) revisit, as is true about any security procedures.