Security
AnalyticDB for PostgreSQL provides layered security controls across network access, authentication, data encryption, and audit logging. This page describes each layer and how to configure it.
Network isolation and access control
Each AnalyticDB for PostgreSQL instance runs inside a Virtual Private Cloud (VPC) — an isolated virtual network that provides higher security and performance than classic networks. By default, instances are accessible only within the VPC.
To control which clients can connect, configure an IP address whitelist in the AnalyticDB for PostgreSQL console. Only IP addresses and CIDR blocks listed in the whitelist can establish connections. Enable a public endpoint only if your application requires internet access; leave it disabled to reduce the attack surface.
To encrypt data in transit, enable SSL/TLS on the instance. The SSL protocol was renamed to Transport Layer Security (TLS) after SSL was standardized by the Internet Engineering Task Force (IETF). The console provides CA certificates for applications to download and update securely. For stronger identity verification, enable mutual authentication certificates, which verify both the server and client identities.
Account and permission management
AnalyticDB for PostgreSQL supports two account types:
| Account type | Permissions |
|---|---|
| Privileged account | All permissions on all databases |
| Standard account | All permissions on databases explicitly authorized to the account |
Before connecting to databases, create a privileged account in the console. After creation, the privileged account cannot be deleted — only its password can be reset or changed. Passwords are encrypted and stored using the MD5 hash algorithm for plaintext password security.
Permission model
Permissions apply at the database, schema, and table level. For example, grant an account read-only access to a specific table while withholding modification rights.
By default, a new database includes the public schema, which all accounts can read from and write to. Within the schema, an account can access only the objects it owns. To access objects owned by another account, the owner must explicitly grant the required permissions. If the appropriate permissions are granted, you can create objects in other schemas.
A standard account can access only:
Database objects whose permissions have been explicitly granted to it
System-level default objects
Data encryption
AnalyticDB for PostgreSQL supports encryption at two levels: disk and column.
Disk encryption
Disk encryption protects all data stored on instance disks. Your data cannot be decrypted even if it is leaked. Once enabled, it covers:
Static data on the disk
Data transmitted between the disk and the AnalyticDB for PostgreSQL instance
Snapshots generated from the disk and any disks created from those snapshots
Disk encryption is based on Elastic Block Storage (EBS). To use it, select Enhanced SSD (ESSD) or ultra disk as the storage type when creating the instance. Disk encryption cannot be disabled after it is enabled.
Encryption keys are managed by Key Management Service (KMS) and activated by users. ActionTrail records every access to keys.
Column-level encryption
Use the pgcrypto plug-in to encrypt sensitive data at the table or column level. The plug-in provides encryption functions that support the following algorithms:
Hashing: MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512
Symmetric encryption: Blowfish, AES-128, AES-256
Asymmetric encryption: PGP symmetric keys, PGP public keys
Raw encryption
When using pgcrypto, data and keys are transmitted as plaintext between the application and the database. Enable SSL/TLS on the data link to prevent exposure during transmission.
SQL audit
The SQL audit feature records all data manipulation language (DML) and data description language (DDL) operations executed against your instance. Use it to review SQL activity and support compliance audits.
Key characteristics:
Accessible from the AnalyticDB for PostgreSQL console
Covers all DML and DDL statements
Does not affect instance performance