# Query Prod DB

> Query production PostgreSQL with Entra ID authentication for user investigation and data debugging. Use for production database lookups or ad-hoc queries.

- Skill: `learntocloud/query-prod-db` (Agent Skill)
- Install (CLI): `npx skillmds@latest add learntocloud/query-prod-db`
- Raw SKILL.md: https://api.skillmd.com/api/skills/learntocloud/query-prod-db/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: learntocloud (https://skillmd.com/u/learntocloud)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/learntocloud/query-prod-db

---


# Query Production Database

Default to read-only queries. Require Azure CLI authentication and discover the
current PostgreSQL host from Terraform output or Azure; never hard-code its
generated suffix.

Authenticate with an OSS RDBMS access token and the signed-in Entra principal:

```bash
export PGPASSWORD="$(az account get-access-token --resource-type oss-rdbms --query accessToken -o tsv)"
export PG_USER="$(az ad signed-in-user show --query displayName -o tsv)"
psql -h "$PG_HOST" -d learntocloud -U "$PG_USER" --set=sslmode=require -P pager=off
```

The current learner verification state is in `verification_attempts`, keyed by
`user_id` and `requirement_uuid`; step progress is in
`learner_step_completions`, keyed by `user_id` and `step_uuid`. Consult current
models or migrations before querying other columns.

Use bounded results and parameter-safe SQL. Never print tokens. For writes,
show the exact affected rows, explain rollback behavior, and obtain explicit
confirmation before executing a transaction.

If temporary firewall access is necessary, obtain confirmation before adding a
narrow rule for the current IP, record its name, and remove it after the query.