Skip to content
Adventive Adventive Engineering

Provisioning Scripts

provision-db-credentials.sh adds the read-only and read-write MySQL users and passwords to an Adventive database environment, following the connection & credential naming standard. It is the mechanism referenced by Credential provisioning, Steps 1 to 2.

What it does, per (database, mode)

Section titled “What it does, per (database, mode)”
  1. Secrets Manager first. Ensures adventive-db-<db>-<mode>-<env> exists. On first run it generates a 32-character, punctuation-free password and writes {username, password, host, port, database}; on later runs it reuses the existing secret and never silently rotates it. The host recorded is the reader endpoint for a production ro secret and the writer endpoint otherwise.
  2. Then the database. CREATE USER IF NOT EXISTS, sets the password to the Secrets Manager value (the source of truth), and applies schema-scoped grants: SELECT for ro, SELECT, INSERT, UPDATE, DELETE, EXECUTE for rw. Users are created on the writer endpoint only; on Aurora they replicate to the reader.
  3. Verifies. Confirms both users exist and that the read-only user cannot create a table.

Passwords are read from Secrets Manager at run time and are never printed (dry-run redacts them) or committed.

Prerequisites

Section titled “Prerequisites”

Run from the sandbox with the toolchain on the path (aws, cloudflared, mysql, jq). Export, from the sandbox environment or Secrets Manager, never inline:

  • DB_ADMIN_USER, DB_ADMIN_PW: an RDS/Aurora admin able to CREATE USER and GRANT
  • CF_ACCESS_CLIENT_ID, CF_ACCESS_CLIENT_SECRET: the environment’s Access service token

Confirm the tunnel ingress for the environment’s db-* hostnames is live before applying; the script connects through cloudflared access tcp.

Use

Section titled “Use”

Dry-run first, shows every planned action and the exact SQL, changes nothing:

Terminal window
cd ~/Repositories/GitHub/Adventive/adventive-platform-infra/scripts && . ~/Documents/Claude/.cowork-env && ./provision-db-credentials.sh dev

Apply against development:

Terminal window
cd ~/Repositories/GitHub/Adventive/adventive-platform-infra/scripts && ./provision-db-credentials.sh dev --apply

Staging and production modify pre-existing infrastructure and are gated: set CONFIRM_NONDEV_OVERRIDE=1, clear the override in OVERRIDES.md first, and, for production, complete the Secrets Manager IdP-recovery production gate. The script prints the ALERT banner, pauses, and requires you to type the environment name before it proceeds.

Terminal window
cd ~/Repositories/GitHub/Adventive/adventive-platform-infra/scripts && CONFIRM_NONDEV_OVERRIDE=1 ./provision-db-credentials.sh stg --apply

After the users exist, the Hyperdrive configs and Secrets Manager entries are wired up by the infra/cloudflare-hyperdrive/ Terraform module, see Credential provisioning, Steps 3 to 5. This script and the Terraform module read the same Secrets Manager secrets, so the password set here is the password the Hyperdrive config carries.

Placement

Section titled “Placement”

Keep this alongside the infra it drives, in adventive-platform-infra/scripts/. The copy here is the canonical reference published with the standard.