I'm working in an environment where I need to ensure that developers only connect to our application's MySQL database using the username of their Unix account. The driver behind this is to have traceability via MySQL general logs from queries run, back to the user running them. Thus far I haven't found any ideal solutions for this, I have some imperfect ones, and I'm hoping to get some better ideas.
Developers have access to the credentials used by the application (they can access them by logging into the host). I am working on a solution to restrict access to the credentials while still making them available to the application, but there is still desire to ensure that MySQL logs reflect the real users running queries.
Does anyone know of a way that I can restrict
mysql -u <user> to force
<user> to be the logged unix username? The database is hosed on AWS RDS so I don't have a lot of control over it, but I do have full control over the
mysql binary on the connecting machine.
I'm happy to add more info, I'm just not sure what is relevant. Please ask questions and I'll update my own.
Is there any way to do something like wrap the binary to add logic to restrict the
-u switch and call the actually