How many applications actually do, though? At most places I've worked it's common to integrate a schema migration tool (flyway, liquibase) that requires DDL, and I've never seen anyone go to the effort of splitting out an ephemeral instance to run the migration with a separate database connection configuration.
Anecdotal but we certainly run flyway migrations with a high privelage user not the regular low privelage "app" user who can only SELECT UPDATE and sometimes DELETE. The fact that nobody does this doesn't mean it's a bad idea just a reflection on poor industry practice (add it to the list)
Oof, I never let the application alter the tables. Makes running some applications a giant pain, but DDL should be an administrative thing, not a runtime thing.
Comments
Why can’t the attacker with db access drop the trigger?
You could (and should) run with minimal permissions which would exclude DDL.
How many applications actually do, though? At most places I've worked it's common to integrate a schema migration tool (flyway, liquibase) that requires DDL, and I've never seen anyone go to the effort of splitting out an ephemeral instance to run the migration with a separate database connection configuration.
Anecdotal but we certainly run flyway migrations with a high privelage user not the regular low privelage "app" user who can only SELECT UPDATE and sometimes DELETE. The fact that nobody does this doesn't mean it's a bad idea just a reflection on poor industry practice (add it to the list)
Oof, I never let the application alter the tables. Makes running some applications a giant pain, but DDL should be an administrative thing, not a runtime thing.
Sure, but if this person got access to the database, what are the odds they're going to be stuck in a limited role forever?