Ask HN: How do you give developers database access?

We want to keep our databases secure, but sometimes developers need access (think migrations, debugging, business information queries).

Ideally, database access is:

- Connected to existing developer authentication (single sign-on)

- Time limited

- Requires approval

- Leaves an audit trail

How do you achieve these conflicting goals?

Some approaches:

- Put the database in a public subnet and give developers database credentials. This is strongly discouraged by AWS etc (why?). No audit trail or approvals process.

- Put the database in a private subnet with a VPN in a public subnet. Give developers database credentials. This requires credential management for the VPN and you need to pay for an additional server. Access is not time limited. No audit trail or approvals process.

- Something else... ?