Databases

Import from Password Safe to pick from the databases Password Safe already discovered — it knows the platform, port and accounts, so there is nothing to type. Register one by hand if it isn't in Password Safe. Or provision a new one: managed databases are built private (no public endpoint) and reached only through a BeyondTrust PRA protocol-tunnel jump. PostgreSQL, MySQL, and SQL Server across AWS, Azure, and GCP are supported, plus Oracle on OCI. Provisioning needs a Terraform module, so it's cloud-only; registering isn't.

Region:

Loading…

No databases yet. Click Provision database to create a private managed instance, Import from Password Safe to pick from the ones it already knows about, or Register existing to record one by hand.

Engine	Database	Location	Region	Workstream	Status	Endpoint (private)	PRA tunnel	Actions
				–		(pending)	brokered none	Password Safe ✓ DB grant ✓

Password Safe DB-Ops services — the Cloud Run channel, one per GCP region

Password Safe's GCP Cloud SQL plugins reach a SQL Server instance through this service, because Cloud SQL for SQL Server has no IAM database authentication. It sits inside the VPC, keeps one warm instance (a few dollars a month) and is callable only by the invoker service accounts configured in Settings.

No GCP region is configured.

Workstream

Everyone in the chosen workstream can see and manage — including running Configuration Management against it and changing its auto-delete timer. Clearing the workstream returns it to its creator.

Register an existing database

Record a database the dashboard didn't provision — on-premises or in a cloud — so it can be a Configuration Management target. Nothing is created or changed; removing it later deregisters it and leaves the database alone.

Engine

Location

Host

Port

Database name (optional — SQL Server uses master)

Admin account (Password Safe — checked out just-in-time)

Looking up managed accounts…

No Password Safe managed accounts found for this host. Enter the host above, then onboard it in Password Safe — the dashboard never stores a database credential.

Workstream

Everyone in this workstream can see and manage it. Leave blank and only you and administrators can.

Import from Password Safe

Databases Password Safe already knows about. Importing records them here so they can be Configuration Management targets — the credential stays in Password Safe and is checked out at run time. Nothing in Password Safe is created or changed.

Reading Password Safe…

BeyondTrust is turned off. Enable it in Settings → Integrations → BeyondTrust.

Showing the first — set an import workgroup in Settings → Integrations → BeyondTrust to narrow the list rather than raising the cap.

Location

Applies to everything in this batch. Password Safe does not record a cloud, and this decides which runner reaches the database — a wrong value fails the run, not the import.

Password Safe has no database managed systems to show.

	System	Engine	Endpoint	Account
				none

Imported ; could not be imported:

Provision database —

Cloud *

Engine *

License-included SE2 (the Oracle licence is in the hourly price) on at least db.t3.small. Creation takes 20–40 minutes.

Region *

Configured regions only — a private database needs its own subnet there. Add one under Settings → Multi-region.

Name *

Workstream

Everyone in this workstream can see and manage this database. Leave blank and only you and administrators can.

Loading options…

Admin username

Instance class

Machine tier

SKU

Cluster tier

Workload

Storage (GB)

DB subnet group

No DB subnet groups in this region — the VPC default group will be used (if any).

VPC security groups

No security groups found.

None selected — the configured DB security group will be attached.

None selected and no DB security group is configured — the VPC default security group will be attached, which permits no ingress on the engine port, so the tunnel to this database will time out.

Disk size (GB)

Private network (optional)

VPC the private IP lands on. Blank uses the configured gcp_db_network.

Storage (GB)

Minimum 32 GB.

The delegated subnet + private DNS zone come from the configured azure_db_* sandbox settings.

Creates a MongoDB Atlas cluster in its own Atlas project, on in this region beside the PRA gateway. Its endpoint is public but admits only the gateway's egress IP. Flex costs roughly $8–30 a month; dedicated M10+ starts around $57. The tunnel reaches one replica-set member, so connect with directConnection=true.

Provisions an Always-Free Autonomous Database (1 OCPU / 20 GB, public endpoint reached via the PRA tunnel). The admin user is ADMIN; the compartment comes from the configured oci_compartment_ocid.

Allow beyond free tier (dedicated sizing / private endpoint — may incur charges)

OCPUs

Storage (TB)

Subnet OCID (private endpoint)

PRA Vault account group

The injected DB credential is placed in this Vault account group; a group policy then grants it to users. Leave unset to create the account ungrouped (lands in Default — assign it later in PRA).

The instance is created private-only and onboarded to a PRA tunnel (when PRA is configured). The admin password is generated and stored encrypted — never shown.

Onboard into Password Safe (managed system + rotatable managed account) Creates a dedicated database user for Password Safe to rotate, and points the PRA tunnel's injected credential at it instead of the master admin. Needs Password Safe database onboarding enabled and its plugin configured (Settings → Integrations → Password Safe); AWS, Azure and GCP. You can also do this later with the row's Register in Password Safe action.

BeyondTrust PRA options — optional; fall back to the configured defaults.

Asset group

Gateway

No PRA Asset Groups/Gateways returned — the tunnel falls back to the configured defaults (check PRA config to pick per-DB).

PRA credential

Resolved to a bt_client_secret override for this DB's tunnel provisioning.

Connection

This database has no public endpoint. Reach it by opening its BeyondTrust PRA protocol-tunnel jump.

engine:

private host:

database:

PRA jump id:

status:

The PRA tunnel hands your client cleartext on 127.0.0.1, so disable client TLS: mysql --ssl-mode=DISABLED …

The PRA tunnel hands your client cleartext on 127.0.0.1, so connect with ?sslmode=disable.

The PRA tunnel hands your client cleartext on 127.0.0.1, so disable client encryption: sqlcmd -S 127.0.0.1,<port> -U … -P … -d master -No -C

A raw TCP tunnel: PRA forwards the listener to 127.0.0.1 on the same port, and the database's own TLS (if any) passes straight through. Connect to the service: sqlplus …@//127.0.0.1:<port>/<service> (Autonomous DB's listener is TLS-only — use a tcps:// descriptor).

A raw TCP tunnel to one server, so connect directly (not via SRV) and, since 127.0.0.1 is never the name on the server's certificate, relax hostname checks: mongosh "mongodb://127.0.0.1:<port>/?directConnection=true&tls=true&tlsAllowInvalidHostnames=true&authSource=<database>"