Scaling and Securing Postgres Data Connections

Postgres databases are known for having a high number of connections. Additionally, thes user need authenticate to ensure the appropriate, limited access is given. In this blog, we will discuss how Postgres customers deployed the the Heimdall Database Proxy and PAM .

Challenge

High connection counts can easily overwhelm Postgres databases. Most users utillize the connection pooling feature either from an application stack (e.g. library) or deploy a database connection pooler to minimize the front end to back end connections, lightening the Postgres traffic load.

While Postgres can authenticate users to LDAP, it does not have the ability to authorize, granting database access based on the LDAP user group. There is no support mapping between Active Directly user group and the Postgres user roles. Hence, Postgres users much manually create and manage a separate set of credentials on the database. This results in management overhead, regulatory non-compliance, and potential data leakage.

This e-commerce customer with multi-tenant databases need a solution that provide enhanced security and scalability without mimimal infrastructure changes.

Solution

The customer choose the Heimdall Database Proxy and PAM solution to improve connection management while authortize users for their Amazon RDS for Postgres environment. While Amazon RDS provided the managed services for database maintenance, scalability, and availability; the Heimdall Proxy solution allowed the customer get the most out of these Amazon RDS features without application changes.. Features deployed included:

Advanced Connection Pooling: Reduced the number of Postgre connections via connection reuse, and eliminating idle connections.
SQL Results caching: Offload traffic load from Postgres
Active Directory Policy Enforcement: Heimdall Data integrated with traditional Enterprise IAM solutions to authenticate application-database requests using IAM roles and SAML/OIDC federation, ensuring that only authenticated principals can obtain database credentials.
Database Firewall: Block malicious queries and masked sensitive data retrieved from the Postres database.

By multiplexing connections and isolating sessions per user, Heimdall Data tracks and logs privileged database activities. Detailed audit trails and replayable sessions support forensic analysis and compliance reporting.

Integrating with AWS Services

Heimdall integrated with AWS Secrets to store any fixed password (such as for service accounts), and allowed upstream applications to both connect to us, and us to connect to back-end services using the stored secrets. This included the rolling of passwords in conjunction with RDS, when accounts are configured in Secrets Manager. -Most customers leverage this functionality to reduce the management complexity of service accounts (at a minimum).

We also integrated with AWS Directory Service and Active Directory, allowing for easy management of users in a corporate directory for personal accounts (and service accounts if desired). This was primarily focused on the users connecting through the Heimdall Proxy, and then using the directory to provide guidance on provisioning the user in a JIT manner on the database, simplifying user management. This can be done with either Kerberos or LDAP. In this case, Kerberos was implemented.

Additional integration included for AWS IAM Identity center, which allowed users using the Heimdall PAM to do privilege escalation requests in an SSO type setup, simplifying user access for these advanced features. As SAML and similar technologies did not directly fit with database access, this was an important way to simplify access control in a database environment, while maintaining improved controls.

Finally, for logging of audit trails, we the customer used AWS Cloudwatch, including fo logs and metrics, allowing for alerts to be automated within AWS.

Customer Benefit

Ensured data was not exposed to other customers in a multi-tenant environment via data masking
Save 1-2 database engineer resources from manage creditials on Postgres. All authentication and authorization was now performed via Active Directory.
Fulfilled regulatory compliance standards (SOC2, SOX)
Fulfilled SoD (Segregation of Duties) governance
Improved database scale 35% due to SQL offload (query caching and connection pooling)
Saved database resources from managing and maintaining Postgres with the use of Amazon RDS for Postgres.

Challenge

Leave a Reply Cancel reply