Skip to main content
PostgreSQL discovery scans a set of PostgreSQL instances, enumerates the roles that can log in, stages them for review, and lets you import them into PAM as PostgreSQL accounts. You list the instances to scan and the PostgreSQL accounts to scan with. All scan traffic is tunneled through an Infisical Gateway.

​
How it works

A PostgreSQL scan connects entirely through the Gateway:
  1. Each target you list is one instance to scan. Hostnames are resolved by the gateway in the target network.
  2. Each target is probed on the ports of your credential accounts, so unreachable ones are skipped before any login is attempted.
  3. For each reachable host, discovery picks a credential account: it first tries an account whose stored host matches the target, otherwise it tries each account in turn until one connects.
  4. It reads the roles defined on the instance.
  5. Each role that can log in is staged as a PostgreSQL account scoped to that instance. postgres on two instances becomes two separate staged accounts.
Hosts that no credential can reach or authenticate to are reported on the run and skipped; the rest of the scan still completes.

​
Prerequisites

Before creating a PostgreSQL discovery source, make sure you have:
  • A Gateway (or Gateway pool) with network access to the instances you want to scan.
  • One or more PostgreSQL accounts in PAM to use as credential accounts. Discovery connects to each instance as one of these accounts, using its port, database, and TLS settings.
  • The Product Admin role. See Access Control.
The scanning account needs no special grant or elevated privileges. Any role that can log in is enough to enumerate an instance.
Only password authentication can drive a scan. An AWS IAM account’s token is minted for one host, port, and user, so it cannot be reused across the instances a source scans. IAM accounts cannot be used as credential accounts.

​
Creating a source

1

Start adding a source

Go to Privileged Access Manager → Discovery and click Add Source, then choose PostgreSQL.
2

Configure the source

3

Save

Click Add Source. The source appears in the Discovery table.

​
Account filtering

Discovery surfaces only roles that can log in. Group roles that exist purely to hold privileges cannot open a session, so they are not accounts and are dropped, as are PostgreSQL’s own built-in roles. Roles are cluster-wide rather than per-database, so the database your credential account connects to does not change which roles are found.

​
Running a scan

Trigger a scan manually with Scan Now from the source’s row menu or its detail panel. Scans run in the background, and a source can only have one scan running at a time. If the source is on a Daily or Weekly schedule, Infisical also scans it automatically when its interval has elapsed. Manual sources are only scanned when you trigger them.

​
Importing accounts

From the Staged Accounts tab, select the accounts you want and click Import Accounts. Then choose: Once imported, the accounts become regular PAM PostgreSQL accounts in the chosen folder and inherit their template’s rules.
Imported accounts arrive without a credential because discovery finds roles with a name but no password. Open each imported account and add a credential before connecting.

​
Next steps

Discovery Overview

Understand staging, importing, and schedules.

PostgreSQL Accounts

Learn about the account type used to authenticate scans.