PostgreSQL

​

Supported Versions & Platforms

​

Connection Settings

​

SSL Mode Options

• Security: Encrypts all data in transit, protecting against network sniffing
• Compliance: Required for SOC2, HIPAA, PCI-DSS, and other security standards
• Cloud providers: Most managed databases (RDS, Aurora, Cloud SQL) require or strongly recommend SSL

• Local development databases on localhost
• Databases on a private network with no external access
• Testing environments with non-sensitive data

​

Choosing an SSL Mode

​

Recommendations by Environment

​

SSH Tunnel (Bastion Host)

​

When to Use SSH Tunnel

• Database is in a private subnet with no public IP
• Firewall rules prevent direct connections
• Security policy requires bastion host access

​

SSH Tunnel Settings

​

Key-Based Authentication (Recommended)

1. Generate an SSH key pair (or use existing):
   ssh-keygen -t rsa -b 4096 -f anomalyarmor_key
   
2. Add the public key to the bastion host’s ~/.ssh/authorized_keys
3. In AnomalyArmor, paste the contents of the private key file or click Upload Key File

​

Password Authentication

1. Set Authentication Method to Password
2. Enter the SSH password

​

Connection Flow with SSH Tunnel

1. AnomalyArmor connects to your bastion host via SSH
2. An encrypted tunnel is established to your database
3. Database traffic flows securely through the tunnel
4. The tunnel closes automatically after each operation

​

Creating a Read-Only User

-- Create the user
CREATE USER anomalyarmor WITH PASSWORD 'your-secure-password';

-- Grant connection access
GRANT CONNECT ON DATABASE your_database TO anomalyarmor;

-- Grant schema access (repeat for each schema)
GRANT USAGE ON SCHEMA public TO anomalyarmor;
GRANT USAGE ON SCHEMA analytics TO anomalyarmor;

-- Grant read access to existing tables
GRANT SELECT ON ALL TABLES IN SCHEMA public TO anomalyarmor;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO anomalyarmor;

-- Grant access to future tables (recommended)
ALTER DEFAULT PRIVILEGES IN SCHEMA public
GRANT SELECT ON TABLES TO anomalyarmor;

ALTER DEFAULT PRIVILEGES IN SCHEMA analytics
GRANT SELECT ON TABLES TO anomalyarmor;

​

Verifying Permissions

-- Should return tables
SELECT table_name FROM information_schema.tables
WHERE table_schema = 'public' LIMIT 5;

-- Should return columns
SELECT column_name, data_type FROM information_schema.columns
WHERE table_schema = 'public' LIMIT 5;

​

Provider-Specific Instructions

• Amazon RDS
• Amazon Aurora
• Supabase
• Self-Hosted
• Google Cloud SQL

​

Amazon RDS PostgreSQL

Connection Details:

• Host: Your RDS endpoint (e.g., mydb.abc123.us-east-1.rds.amazonaws.com)
• Port: 5432 (default)
• SSL Mode: require

Security Group Configuration:

1. Go to AWS Console → RDS → Your Instance → Security Groups
2. Edit inbound rules
3. Add rule:
   • Type: PostgreSQL
   • Port: 5432
   • Source: AnomalyArmor IPs (see Settings → Security)

Parameter Group (if using verify-ca or verify-full):

• Ensure rds.force_ssl = 1
• Download RDS CA certificate bundle

RDS instances in private subnets require NAT Gateway or VPC peering for AnomalyArmor access. Contact us for Enterprise VPC peering options.

​

Amazon Aurora PostgreSQL

Connection Details:

• Host: Cluster endpoint (reader or writer)
• Port: 5432 (default)
• SSL Mode: require

Choosing the Right Endpoint:

Endpoint	Use Case
Cluster (writer)	If you need real-time schema changes
Reader	Recommended - no impact on production writes

Aurora Serverless v2:

• Use the cluster endpoint
• Ensure minimum ACU allows connections during discovery
• Consider scheduling discovery during active hours

​

Supabase PostgreSQL

Connection Options:

Method	Host	Port	When to Use
Direct	db.xxx.supabase.co	5432	Standard setup
Pooler (Transaction)	xxx.pooler.supabase.com	5432	High connection limits
Pooler (Session)	xxx.pooler.supabase.com	6543	If direct fails

Finding Your Credentials:

1. Go to Supabase Dashboard → Settings → Database
2. Copy the connection string or individual fields
3. Use the database password (not the API key)

SSL Configuration:

• SSL Mode: require
• Supabase enforces SSL by default

Don’t use the Supabase API key as the password. Use the actual database password from Settings → Database.

​

Self-Hosted PostgreSQL

Connection Details:

• Host: Your server’s hostname or IP
• Port: 5432 (or custom port)
• SSL Mode: Depends on your setup

Firewall Configuration:Allow inbound connections from AnomalyArmor IPs:

# iptables example
iptables -A INPUT -p tcp --dport 5432 -s 34.xxx.xxx.xxx -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -s 34.xxx.xxx.xxx -j ACCEPT

pg_hba.conf Configuration:Add entries for AnomalyArmor:

# TYPE  DATABASE  USER           ADDRESS         METHOD
hostssl all       anomalyarmor   34.xxx.xxx.xxx/32  scram-sha-256
hostssl all       anomalyarmor   34.xxx.xxx.xxx/32  scram-sha-256

SSL Setup (if not already configured):

# Generate self-signed certificate (for testing)
openssl req -new -x509 -days 365 -nodes \
  -out server.crt -keyout server.key

# Set permissions
chmod 600 server.key
chown postgres:postgres server.key server.crt

# Enable in postgresql.conf
ssl = on
ssl_cert_file = '/path/to/server.crt'
ssl_key_file = '/path/to/server.key'

​

Google Cloud SQL for PostgreSQL

Connection Methods:

Method	Description
Public IP	Add AnomalyArmor IPs to authorized networks
Cloud SQL Proxy	For private IP instances (self-managed)

Public IP Setup:

1. Go to Cloud Console → SQL → Your Instance → Connections
2. Under Authorized Networks, click Add Network
3. Add each AnomalyArmor IP

Connection Details:

• Host: Public IP from instance overview
• Port: 5432
• SSL Mode: require

Cloud SQL requires SSL by default. If you need verify-ca, download the server certificate from the instance details.

​

Connection Pooling Considerations

​

PgBouncer

• Transaction mode: Works with AnomalyArmor
• Session mode: Recommended for best compatibility
• Statement mode: May have issues with complex queries

​

Connection Limits

1. Use a read replica for monitoring
2. Schedule discovery during off-peak hours
3. Increase max_connections if possible

​

What We Query

-- Tables and views
SELECT * FROM information_schema.tables
WHERE table_schema NOT IN ('pg_catalog', 'information_schema');

-- Columns
SELECT * FROM information_schema.columns
WHERE table_schema NOT IN ('pg_catalog', 'information_schema');

-- Constraints
SELECT * FROM information_schema.table_constraints;

-- Freshness (for timestamp columns)
SELECT MAX(your_timestamp_column) FROM your_table;

​

Troubleshooting

-- Grant schema access
GRANT USAGE ON SCHEMA public TO anomalyarmor;

-- Grant table access
GRANT SELECT ON ALL TABLES IN SCHEMA public TO anomalyarmor;

​

Common Questions

​

Which PostgreSQL-compatible services does AnomalyArmor support?

​

What SSL Mode should I use for RDS or Aurora?

​

My PostgreSQL is only reachable through a bastion host. Can AnomalyArmor still connect?

​

Does AnomalyArmor support PostgreSQL logical replication or CDC?

​

How do I give AnomalyArmor access to future tables without re-granting permissions?

ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO anomalyarmor;

​

Next Steps