Pretty sure every one has their own spin to this. I didn't want to share the credentials with my agent, so built a thin layer that allows my agent to freely query the database, especially helpful when triaging bugs when paired with aws cloudwatch cli and datadog cli