RWB has implemented a company-wide database access management architecture centered on Trino and Open Policy Agent (OPA), replacing ad-hoc manual grants with a centralized, auditable process.
Previously, users received full database access rather than granular table or schema permissions. Revocation depended on manual HR synchronization, new access requests took between one and 17 days, and audit trails were incomplete. The company determined that these issues would not scale with growth and required a unified solution meeting strict requirements: no anonymous or password access, minimum necessary privileges, full operation logging, and a digital record of every access request and approval.
The architecture uses Trino Coordinator and Worker nodes to handle queries, OPA to evaluate Rego policies on every request, Keycloak for OIDC authentication, Vault for secrets, Kafka for security event delivery to SOC, and Kubernetes for orchestration. Policies are generated automatically from access matrices stored in GitLab, versioned, tested via CI/CD, and deployed to S3 without service restarts. Granularity reaches column level when needed, though catalog/schema/table is the standard operating scope.
Three request flows were established: project-level access matrices processed through merge requests with automated checks, point-in-time additions to existing groups via Service Desk with two-level approval, and temporary 24–72 hour access with automatic revocation. HR integration now triggers instant access removal upon employee departure, while an independent Access Management team can revoke rights in seconds during emergencies.
All Trino traffic is streamed through an event listener to Kafka and then to SOC, where custom alerts detect enumeration, unauthorized DDL/DML, anomalous query volumes, and impersonation. Incident escalation follows a three-tier model with SOC handling L1, DevOps and Access Management covering L2, and Data Security engaged at L3. Long-term logs reside in S3 per regulatory guidance.
Results include 1,250+ PostgreSQL clusters connected, 700+ daily users, 90+ projects onboarded, and access provisioning reduced to minutes. Real-time BI dashboards track cluster health and project maturity, while 24/7 support channels and training materials assist end users.
