Back to the project in the portfolio
Architecture diagram

RDS database access with Slack approval

A developer no longer connects straight to a database: they run a tunnel script that opens an approval request in Slack through an SSM document. The tunnel only exists once the request has been approved — and every open connection is then flagged in Slack.

Generic diagram: instances, repositories, channels and modules are named by function. The architecture is shown for illustration, independently of any organisation.

Technical step External service · database Awaiting approval Approved Denial · alert
01 — request, decision, monitoring

Opening a tunnel under approval

The script is called twice: once to file the request, and once — after the verdict — to actually open the tunnel. In between, nothing is open.

Dev requests access Tunnel script run by the dev EventBridge rule 1 Lambda 1 creates the request SSM document status: waiting Slack request bot The script, both Lambdas and the SSM document each carry their own IAM permissions. request posted Approvers Slack channel approved SSM document status: success Tunnel script opens the tunnel session RDS connection tunnel open refused No access the request stops here connection detected EventBridge rule 2 Lambda 2 reports the opening Slack alert database connection connection alert Every open connection is flagged in Slack, whether it was approved or not.
Two distinct loops go through Slack: the top one asks for authorisation, the bottom one reports what actually connected — the second does not depend on the first, which is what makes a connection that bypassed the request visible.

All architecture diagrams