Skip to main content
PostgreSQL discovery finds the roles that can sign in to your PostgreSQL instances, so you can import them into PAM as PostgreSQL accounts. For how discovery works across every source type, see Discovery. You give the source a list of instances and one or more PostgreSQL accounts to sign in with. Infisical connects to each instance through a Gateway.
  1. Infisical checks that each instance is reachable on the ports of the source’s PostgreSQL accounts, and skips the instances it can’t reach
  2. For each instance, Infisical first tries the account whose host matches the instance, then tries the other accounts until one signs in
  3. Infisical lists the roles on the instance that can sign in, and stages each one as a PostgreSQL account for that instance
If two instances each have a role named postgres, Infisical stages two separate accounts. If no account can sign in to an instance, the scan reports the instance and continues with the others.

​
Prerequisites

  • A Gateway that can reach the instances you want to scan
  • One or more PostgreSQL accounts that authenticate with a password, to sign in to the instances with
  • The Product Admin role in PAM
  • The Operator or Admin role on those PostgreSQL accounts, because the scan sends their passwords to every instance
The PostgreSQL role that the scan signs in as only needs permission to sign in to the instance. It doesn’t need to be a superuser. A PostgreSQL account that uses AWS IAM authentication can’t scan, because its sign-in token works for only one host, port, and user.
Infisical sends the PostgreSQL account’s password to every instance that the source scans, so only list instances you trust.

​
Step 1: Create a source

1
Go to Privileged Access Management > Discovery and select Add Source.
2
Select PostgreSQL, then select Next.
Add Discovery Source panel with PostgreSQL selected
3
Configure the source:Infisical connects to each instance with the port, database, and TLS settings of the PostgreSQL account it signs in with.
PostgreSQL discovery source configuration with name, credential accounts, gateway, scan schedule, and targets fields
4
Select Add Source.

​
Step 2: Run a scan

On the Discovery Sources table, select the options menu on the source’s row, then select Scan Now. A source can run one scan at a time.
PostgreSQL discovery source row menu showing Scan Now
The scan stages only roles that can sign in. Roles are shared across all databases on an instance, so the database that the PostgreSQL account connects to doesn’t change which roles the scan finds.

​
Step 3: Import accounts

1
On the Discovery Sources table, select the source.
2
On the Staged Accounts tab, select the accounts you want, then select Import Accounts.
Staged Accounts tab with four PostgreSQL accounts selected and the Import Accounts button
3
Select a Destination Folder and a PostgreSQL Template, then select Import.
Import 4 Accounts dialog with Production as the destination folder and PostgreSQL Standard as the template
4
Go to Privileged Access Management > Accounts. For each imported account, open the options menu on its row, select Configure, and enter the password for its PostgreSQL role on the Configuration tab. The scan doesn’t read passwords, so you can’t connect to an imported account until you enter its password.
Your PostgreSQL roles are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new roles it finds.