Database access management
Broker database access without handing out connection files.
Shortspan registers database targets alongside the projects and environments they support. Developers connect through a controlled CLI workflow, including through a configured SSH bastion when the database is not directly reachable.
Why teams change
Database access spans more than a password.
A useful connection needs a host, port, database name, username, credential, TLS expectations, and sometimes a bastion. When those details live in separate documents and password stores, every onboarding and rotation becomes a coordination exercise.
Shortspan keeps the target and its credential relationship together under a project boundary. The CLI assembles the approved connection for the native database client, while role and grant checks decide whether the requester can use it at that moment.
What Shortspan adds
Control around the workflow, not another workflow beside it.
PostgreSQL and MySQL targets
Model the connection details developers need under stable aliases that reflect the service or environment.
SSH bastion routing
Reach a private database through a registered SSH target without asking every developer to maintain a bespoke tunnel command.
Access checks and audit context
Apply workspace and project permissions before the connection is brokered and retain the actor, resource, and time for review.
The workflow
From registered resource to accountable use.
- 01
Register the database target
Store the endpoint, database identity, and credential material inside the appropriate project.
- 02
Attach the network path
When required, associate the target with the SSH bastion that reaches its private network.
- 03
Open the approved client session
Use the database alias from the CLI and let Shortspan broker the configured client workflow.
Operational outcomes
Make the secure path the understandable path.
- Fewer connection strings and passwords copied between developers
- Repeatable bastion access for private databases
- Project-scoped visibility across database targets
- A consistent offboarding and temporary-grant boundary
Common questions
Know where the boundary is.
- Which databases are supported?
- The current target catalog supports PostgreSQL and MySQL connection workflows. Consult the CLI database documentation for client requirements and current flags.
- Can Shortspan reach a database on a private network?
- Yes, when the project has a configured SSH target that can act as the bastion for that database connection.
- Does Shortspan replace database authorization?
- No. The database still enforces the permissions of the underlying database identity. Shortspan adds a governed path for deciding who may ask to use the configured connection.
Read the implementation details
Documentation for this workflow
Related solutions
Connect the next part of the workflow
Start with one project and one access problem.
Create a workspace free, or tell us what your team needs to broker, approve, and review.