Adam R.

I've got a use case that is proving difficult in Motherduck. I have a service account that runs my dbt packages, creating tables across 6 different databases. I have shared these databases with some business users, which works great for read only work. However, some of these users have a need to write (running ad hoc scripts that create tables or insert into tables) which can't be done on their shares, and they can't write to the main databases because they are owned by the service account. The only workaround I can think of is to issue the user a token with access to the underlying databases and then have them connect with something like Datagrip or the cli to execute their procedures. Am I missing something fundamental here, or is this the intended way that this work should be accomplished?

Hi friends, I'm a consultant using Motherduck for all of my data warehouse needs and it's great. I'm running into an issue where potential clients are asking to see the results of 3rd party penetration tests/security audits of my systems and the platforms I use, and I'm having a hard time finding folks who will do this for my Motherduck environment. They are all happy to take a look at my Azure setup, Entra ID, my workstation policies, etc. But they have never heard of Motherduck, don't feel competent to review/audit the setup, and aren't willing to learn just for me since I'm a tiny company who isn't going to end up paying them much money. Have any of you worked with pentesters or other security professionals who are willing/able to audit and/or pentest my MD environment? It would make my life a lot easier if I could find someone. Thanks! CC: Bill Z.

I'm pretty sure that there's currently no way to restrict the scope of a token's access to a specific database/set of databases, and also not possible to restrict token access by IP. I know the ip allowlist thing is on the roadmap, but not sure when that's coming. What are people doing to reduce risks around tokens (besides rotating them)?

Generally, is the underlying compute the same between the Lite Standard and the Business Standard plans? Or is lite/standard "lighter" than business/standard?