I85PREP
⌘ K
EDB PostgreSQL Professional study materials
EDB PostgreSQL Professional study resources

EDB PostgreSQL Professional: Security and EDB Postgres AI Platform Operations

EDB PostgreSQL Professional · Work through your exam, one topic at a time.

All guide sections

Security and EDB Postgres AI Platform Operations

This domain tests hardening (authentication, least privilege, row-level security, TLS) and operating the EDB Postgres AI Platform's monitoring and management layer alongside AI features such as vector search.

Authentication and authorization

  • pg_hba.conf methods: scram-sha-256 (default since PostgreSQL 14, supports channel binding over TLS), legacy md5, cert, peer/ident, ldap, gss. Set password_encryption = scram-sha-256; existing md5 hashes convert on the next password change.
  • Least privilege: NOLOGIN group roles, explicit schema grants, ALTER DEFAULT PRIVILEGES for future objects, and removal of PUBLIC CREATE on schema public.
  • Row-level security: ENABLE ROW LEVEL SECURITY plus CREATE POLICY. Owners and superusers bypass policies unless you also run FORCE ROW LEVEL SECURITY; the BYPASSRLS attribute also overrides.
  • In SECURITY DEFINER functions, pin SET search_path = pg_catalog, <schema> to block search-path hijacking.
  • TLS: ssl = on, a modern ssl_min_protocol_version, and clientcert=verify-full where certificate auth is required.

Platform operations

Register servers in the platform console, deploy monitoring agents, tune probes and alert thresholds, and review capacity, audit and log data. The agent's database role needs monitoring privileges such as pg_monitor - not SUPERUSER. For AI workloads, vector columns with HNSW or IVFFlat indexes trade recall against latency and build time.

Worked example

Enforce tenant isolation on docs(tenant_id, body) for role app_user. Reasoning: a view alone is bypassable, so filter at the table. ALTER TABLE docs ENABLE ROW LEVEL SECURITY; then CREATE POLICY tenant_pol ON docs USING (tenant_id = current_setting('app.tenant')::int);, grant SELECT, and add FORCE ROW LEVEL SECURITY so the owning role is also constrained.

Traps that cost marks

Granting SUPERUSER to monitoring agents; leaving trust in pg_hba.conf; forgetting FORCE RLS and letting the owner read everything; assuming md5 is still the default; building a vector index without measuring recall.