Automated CockroachDB Cluster Access Audits
Every Monday, WebRun opens CockroachDB Cloud, lists the SQL users, service accounts, organization members, and IP allowlist entries on every cluster, compares them against last week, files each change as a Trello card for review, and sends you the diff on WhatsApp.
How do I audit who can access my CockroachDB clusters?
WebRun opens CockroachDB Cloud every Monday and lists the SQL users, service accounts, organization members, and IP allowlist entries on each cluster. It diffs them against last week, files every change as a Trello card for review, and sends you the summary on WhatsApp, so a contractor's access never outlives the project.
- Stale contractor access is caught within a week of the project ending
- Every allowlist widening is reviewed by a human before it stays
- A quiet week is confirmed explicitly rather than assumed from silence
Built for platform engineers · DevOps leads · security teams · data engineering
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
cockroachlabs.cloudin a real browser with your saved login - no setup, no API keys. -
1
CockroachDB - list users and allowed networks
cockroachlabs.com
WebRun opens CockroachDB to list users and allowed networks. - Sign in to CockroachDB Cloud and open each cluster in the organization
- List the SQL users defined on every cluster
- List the service accounts and note which have active keys
- Record the IP allowlist entries with the network range and any label on each
- List organization members and their roles
- Compare the whole set against last week's reading and mark what is new, removed, or changed
Done when Every cluster's users, service accounts, allowlist entries, and members are captured and diffed.
-
2
Trello - file each access change for review
trello.com
WebRun opens Trello to file each access change for review. - Create a card for each new or changed access entry on your platform review board
- Name the cluster, the entry, and what changed since last week
- Add a card for anything that looks stale: an allowlist range nobody claims, a service account with an unused key, a member who left
- Leave every card open for a human to approve or revoke. WebRun never removes access itself
Done when Every access change has a Trello card waiting for review.
-
3
WhatsApp - send you the weekly diff
whatsapp.com
WebRun opens WhatsApp to send you the weekly diff. - Send the platform lead a short summary of what changed this week
- Give counts first: users added, users removed, allowlist entries changed
- Name anything that widens access, such as a broad network range
- Say plainly when nothing changed, so a quiet week is confirmed rather than assumed
Done when You have this week's access diff on WhatsApp.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it revoke access or delete a user?
No. WebRun only reads the access lists and reports what changed. It never deletes a SQL user, rotates a key, removes an allowlist entry, or changes a role. Every revocation is done by a human.
Does it read any of our data?
No. It reads the cluster access configuration in the CockroachDB Cloud console: users, service accounts, members, and allowed networks. It does not connect to a database or run a query.
What does a quiet week look like?
You still get a message confirming nothing changed. Silence is ambiguous in a security check, so WebRun states the counts either way rather than only speaking up on a change.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.