[sgt101]

I would build a rest service that provides the code to do this, and I would test it extensively before releasing it as the mechanism to effect the change.

In addition I would build a validation service that checks and tests the update data (the list of changes) before they are submitted to the change service.

I would not permit any adhoc changes to the prod database. The rest service should be the only way for a mutation to be done short of a complete new release.

[random_kris]

So a month worth of engineering effort for something, that you would use once a month ?

If you need to upgrade production stuff more than that you have problems elsewhere.

[sgt101]

A month of effort to avoid a day of downtime, and six months of unemployment.

I worked in a business where if the website went down we missed £26m revenue. This is not a particularly big business in the modern sense. However, one MD had a screwed up migration that didn't have a good roll-back plan. There was a missed day of revenue, and he - and several others in his top team - left the business within a calendar month.

This kind of thing colours my view on prod risk.