We've got one of our projects using a Google CloudSQL Postgres DB. We really like the cloudsqlproxy and how it keeps access to the DB locked behind our google accounts (which have 2FA).
We've got another project using a DB on another managed service. Moving off that service is not an option, but we'd like to try and secure logins to it - right now it's just plain old psql user/pass credentials protecting it.
I'm thinking the solution might be to set up a container running a similar kind of proxy that does some smarter authentication before opening up a proxy port for our team members.
A simple idea be to setup a box in the middle that does SSH with port forwarding and then have the PSQL server whitelist only that box, but some of our team are not very technical, so we'd need to build some scripts around it and it doesn't feel like a great solution.
The ideal solution would be pretty close to cloudsqlproxy so it can leverage existing accounts rather than us have to create a new account and somehow tie it into some kind of 2FA.
I've googled, but struggling to find a good solution. Maybe the whole approach is wrong and there's some other way to achieve the goal of better securing the server.
