Ephemeral credentials for databases: moving past the shared application account

A shared database account is a familiar design. An application reads its connection string from configuration, all replicas use the same username and password, and rotation means a coordinated restart across every service that depends on it. Rotation therefore happens rarely or not at all.

Why the static credential persists

The convenience is real. Connection pools assume a stable identity. Database proxies, failover, and read replicas all inherit the same secret. Introducing per-instance credentials appears to add operational risk rather than remove it.

What short-lived credentials change

Dynamic secrets are issued on request and expire on a schedule. Each application instance receives its own credential, so revocation affects one instance instead of the fleet. Auditing becomes concrete: the database log shows which instance connected when.

The lifetime should match the workload. A batch job that runs for two hours needs a credential that outlives the job. A web service that can re-authenticate on each connection can use a much shorter window.

Handling the transition

Connection pools are the practical obstacle. Pools must be configured to refresh credentials before expiry, and the refresh must be tested against database failover. Applications should handle a rejected connection by requesting a new credential rather than retrying the old one indefinitely.

Emergency access needs its own path. If the issuing service is unavailable, operators need a documented break-glass procedure, with the use of that path logged and reviewed.

Verifying the control

A credential system is only as good as what it prevents. Confirm that a revoked credential is rejected within the expected window, that a leaked credential from one instance cannot be used by another, and that the audit trail records the subject rather than a shared account.

References

• NIST SP 800-53, Security and Privacy Controls: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
• NIST SP 800-207, Zero Trust Architecture: https://csrc.nist.gov/pubs/sp/800/207/final