Giving a Report Job Temporary Database Access is a practical DevSecOps project for learners who know basic terminal and file operations. Give MarketLedger's report a real, limited PostgreSQL login through OpenBao, produce the actual business summary, and end the job's tested access without interrupting the shop or another report.
Two Guided Labs teach the account permissions and lease lifecycle step by step. An independent Challenge combines them for a different reporting view. Each unit starts with its own prepared data and services.
What You Will Learn
After completing this course, you will be able to:
- limit a generated database login to the reporting view its job needs;
- distinguish the OpenBao operator token, lease ID, database username and password;
- produce a complete TSV with a real dynamically issued PostgreSQL identity;
- revoke the job's exact lease and observe a genuine new-connection password refusal;
- distinguish natural expiry from explicit revocation, recover with a new login, and end that replacement job too;
- preserve private source records, the working shop and an independently issued reporting identity.
Who This Course Is For
This course suits beginning DevSecOps learners, developers and operators who want a concrete introduction to temporary application credentials.
Prerequisites: Basic terminal navigation and familiarity with small text files. The labs explain SQL permission statements, environment variables and credential-file handling before use. Python programming and prior OpenBao administration are not required.
Learning environment: A prepared Linux Terminal, a real local PostgreSQL database and OpenBao service, a working shop client, synthetic orders and the supplied report queries. No local software installation or cloud account is needed.
Frequently Asked Questions
Will I write the reporting application?
No. The query and shop client are provided. You configure the account boundary and use the issued credentials to produce the real report.
Does changing the creation policy fix accounts already issued?
No. Existing accounts keep their earlier grants. The course teaches obtaining a new identity after the final policy change and ending an older unsafe issuance.
Does expiry close every database session?
The exercises verify new password-authenticated connections. They do not claim to terminate every already-open session or clear production connection pools. The prepared management components remain part of the trust boundary.
