That’s the promise of a Database Access Proxy done right — secure, simple, and invisible until you need it. HashiCorp Boundary takes this idea and turns it into a system that locks down direct database connections, replaces static creds with ephemeral ones, and gives you fine-grained control without scattering secrets across your infrastructure.
Boundary sits between your applications or users and the database, mediating every connection. Instead of exposing database ports to the world or handing out long-lived credentials, Boundary brokers identity-based access in real time. That means credentials are created on-demand and wiped when the session ends. No more shared passwords in chat messages. No more VPN sprawl to grant a single query.
The Database Access Proxy feature in HashiCorp Boundary lets you:
- Authenticate users through an identity provider and map them to the right data permissions automatically.
- Connect to PostgreSQL, MySQL, and other supported databases without exposing them to the public internet.
- Generate dynamic, per-session database credentials through a secrets engine integration.
- Enforce session-level logging and auditing to track exactly who did what, and when.
This approach does more than close security gaps. It makes onboarding faster. A new engineer can connect to a production read replica moments after being added to the right group, without waiting for tickets or manual credential rotation. At scale, this means higher productivity and fewer security exceptions.
Unlike jump hosts or homegrown tunneling solutions, Boundary’s access model uses a controller and workers that can live anywhere in your network topology, giving you central policy control while keeping data paths local. With the Database Access Proxy, teams can even embed access rules into CI/CD pipelines, ensuring that only automated processes with the right policies run migrations or read sensitive tables.
Static credentials are a relic. Access brokers like Boundary shift the mindset from “who knows the password” to “who is allowed to ask for a session right now.” That shift reduces blast radius, shrinks attack surfaces, and frees teams to tighten compliance without slowing down work.
If you want to see this kind of secure, ephemeral database access in action without spending days in setup, you can spin up a live example in minutes at hoop.dev — and watch secure access go from concept to reality before your coffee cools.