Skip to main content
PostgreSQL discovery scans a set of PostgreSQL instances, enumerates the roles that can log in, stages them for review, and lets you import them into PAM as PostgreSQL accounts. You list the instances to scan and the PostgreSQL accounts to scan with. All scan traffic is tunneled through an Infisical Gateway.
A PostgreSQL scan connects entirely through the Gateway:
  1. Each target you list is one instance to scan. Hostnames are resolved by the gateway in the target network.
  2. Each target is probed on the ports of your credential accounts, so unreachable ones are skipped before any login is attempted.
  3. For each reachable host, discovery picks a credential account: it first tries an account whose stored host matches the target, otherwise it tries each account in turn until one connects.
  4. Discovery reads the roles defined on the instance.
  5. Each role that can log in is staged as a PostgreSQL account scoped to that instance. If two instances each have a role named postgres, Infisical stages each role as a separate account.
Hosts that no credential can reach or authenticate to are reported on the run and skipped; the rest of the scan still completes.

​
Prerequisites

Before creating a PostgreSQL discovery source, make sure you have:
  • A Gateway (or Gateway pool) with network access to the instances you want to scan.
  • One or more PostgreSQL accounts in PAM to use as credential accounts. Discovery connects to each instance as one of these accounts, using its port, database, and TLS settings.
  • The Product Admin role on your PAM project.
The PostgreSQL role used for the scan only needs permission to log in to the target instance. It doesn’t need superuser privileges or additional grants to list the roles on that instance.
The PostgreSQL accounts used for scanning must authenticate with a password. AWS IAM authentication isn’t supported because each token is valid only for a specific host, port, and user, so it can’t be reused to scan other instances.

​
Step 1: Create a source

1
Go to Privileged Access Manager > Discovery and select Add Source.
2
Choose PostgreSQL, then select Next.
Add Discovery Source panel with PostgreSQL selected
3
Configure the source:
PostgreSQL discovery source configuration with name, credential accounts, gateway, scan schedule, and targets fields
4
Select Add Source. The source appears in the Discovery table.
Discovery only finds roles that can log in to the scanned instance. Group roles that exist purely to hold privileges can’t open a session, so discovery doesn’t consider them accounts and ignores them. Discovery also ignores PostgreSQL’s own built-in roles.Roles are cluster-wide rather than per-database, so the database your credential account connects to doesn’t change which roles are found.

​
Step 2: Run a scan

To trigger a scan manually, select Scan Now from the source’s row menu or its detail panel. Scans run in the background, and a source can only have one scan running at a time.
PostgreSQL discovery source row menu showing Scan Now
If the source is on a Daily or Weekly schedule, Infisical also scans it automatically when its interval has elapsed. Manual sources are only scanned when you trigger them.

​
Step 3: Import accounts

1
In the Discovery Sources table, select the source to open its detail panel.
2
From the source’s Staged Accounts tab, select the accounts you want and select Import Accounts:
Staged Accounts tab with four PostgreSQL accounts selected and the Import Accounts button
3
Configure the import settings:
Import 4 Accounts dialog with Production as the destination folder and PostgreSQL Standard as the template
Then, select Import.
Once imported, the accounts become regular PAM PostgreSQL accounts in the chosen folder and inherit their template’s rules.
Imported accounts don’t include user credentials because the discovery scan doesn’t retrieve passwords from PostgreSQL.After importing, open each account in PAM and enter the password for its PostgreSQL user. You must add the password before you can use PAM to connect to the PostgreSQL instance as that user.

​
Next steps

Discovery Overview

Understand staging, importing, and schedules.

PostgreSQL Accounts

Learn about the account type used to authenticate scans.