How to Secure PostgreSQL Managed Database Clusters

To add a trusted source via the command-line, follow these steps:

1. Install doctl, the DigitalOcean command-line tool.

2. Create a personal access token, and save it for use with doctl.

3. Use the token to grant doctl access to your DigitalOcean account.

                 doctl auth init
               

4. Finally, add a trusted source with doctl databases firewalls append. The basic usage looks like this, but you'll want to read the usage docs for more details:

                 doctl databases firewalls append <database-cluster-id> --rule <type>:<value> [flags]
               

   The following example appends a firewall rule to a database cluster with the ID ca9f591d-f38h-5555-a0ef-1c02d1d1e35 that allows any resources with the example-tag to access the database

                      doctl databases firewalls append ca9f591d-f38h-5555-a0ef-1c02d1d1e35 --rule tag
                   

To add or remove a trusted source using the DigitalOcean API, follow these steps:

1. Create a personal access token, and save it for use with the API.

2. Send a PUT request to https://api.digitalocean.com/v2/databases/{database_cluster_uuid}/firewall

   cURL

   To add or remove a trusted source with cURL, call:

   
                   curl -X PUT \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
     -d '{"rules": [{"type": "ip_addr","value": "192.168.1.1"},{"type": "droplet","value": "163973392"},{"type": "k8s","value": "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61"},{"type": "tag","value": "backend"}]}' \
     "https://api.digitalocean.com/v2/databases/9cc10173-e9ea-4176-9dbc-a4cee4c4ff30/firewall"

   Go

   Go developers can use Godo, the official DigitalOcean V2 API client for Go. To add or remove a trusted source with Godo, use the following code:

   
                   import (
       "context"
       "os"
   
       "github.com/digitalocean/godo"
   )
   
   func main() {
       token := os.Getenv("DIGITALOCEAN_TOKEN")
   
       client := godo.NewFromToken(token)
       ctx := context.TODO()
   
       req := godo.DatabaseUpdateFirewallRulesRequest{
         Rules: []*godo.DatabaseFirewallRule{
           {
            Type:  "ip_addr",
            Value: "192.168.1.1",
          },
           {
            Type:  "droplet",
            Value: "163973392",
          },
           {
            Type:  "k8s",
            Value: "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61",
           },
         },
       }
       _, err := client.Databases.UpdateFirewallRules(ctx, dbID, &req)
   }

   Python

   
                   import os
   from pydo import Client
   
   client = Client(token=os.environ.get("DIGITALOCEAN_TOKEN"))
   
   req = {
     "rules": [
       {
         "type": "ip_addr",
         "value": "192.168.1.1"
       },
       {
         "type": "k8s",
         "value": "ff2a6c52-5a44-4b63-b99c-0e98e7a63d61"
       },
       {
         "type": "droplet",
         "value": "163973392"
       },
       {
         "type": "tag",
         "value": "backend"
       }
     ]
   }
   update_resp = client.databases.update_firewall_rules(database_cluster_uuid="a7a8bas", body=req)