Security Best Practices
Production PostgreSQL security is a bundle of network rules, TLS, SCRAM, least-privilege roles, and audit evidence. These rules apply on RDS, self-hosted Patroni, and serverless Postgres alike.
//
Search across all documentation pages
Production PostgreSQL security is a bundle of network rules, TLS, SCRAM, least-privilege roles, and audit evidence. These rules apply on RDS, self-hosted Patroni, and serverless Postgres alike.
hostssl for remote roles in pg_hba. Reject hostnossl from application CIDRs.sslmode=verify-full with provider CA. Not require alone in production.app user across 12 microservices.REVOKE ALL ON DATABASE ... FROM PUBLIC on new DBs. Default grants are not safe.CREATE or DROP.search_path fixed per role. Prevents object hijacking.CREATE EXTENSION in prod.log_statement = ddl or pgaudit). Schema drift is security-relevant.Private network, TLS, SCRAM, app role without superuser, encrypted managed instance, connection logging.
Terraform policy checks for StorageEncrypted, sqlfluff on migrations, no prod URLs in staging manifests.
No. DBAs still own roles, extensions, and audit. Cloud perimeter is necessary, not sufficient.
Read-only role; network path same TLS rules; row filters via views or RLS.
Extension install, major recovery, break-glass. Never in application Deployment env vars.
Yes. First matching line wins. Put specific reject/hostssl before broad rules.
TLS and SCRAM are cheap. Broad pgaudit read is expensive - scope it.
Preferred over baking DSN in image. Rotate by restarting deployment with new secret version.
Map each checkbox to control ID in SOC2/HIPAA matrix; store evidence screenshots in GRC tool.
Rotate all roles that touched affected data, preserve logs, enable expanded pgaudit, then root-cause.
Stack versions: This page was written for PostgreSQL 18.4 (stable 18, maintenance 17), pgvector 0.8+, PgBouncer 1.x, Patroni 3.x, and PostGIS 3.5+.
Reviewed by Chris St. John·Last updated Jul 19, 2026