The current PostgreSQL configuration allows connections from any host. This is considered a security risk, as it permits connections from all IP addresses.
How can access be restricted to only required hosts, and what is the recommended approach?

Option 1: Restrict Hosts Using a patchConfig.toml File

You can explicitly define the allowed IP addresses in the configuration by creating and patching a config.toml file.

Example:

host = "10.1.0.70,10.1.2.184,10.1.1.9,10.1.0.140,10.1.0.248,10.1.0.81"

1. Execute the configuration patch from the bastion host.
2. Include all required nodes in the host list:
   • All PostgreSQL nodes
   • Chef Automate nodes
   • Chef Infra Server nodes
   • Bastion host

Important Considerations:

• This configuration must be updated whenever nodes are added or removed.
• After any topology change, re-apply the configuration patch from bastion host to ensure continued connectivity.

Option 2: Use Firewall-Based Access Control (Recommended)

Instead of frequently modifying PostgreSQL configuration:

• Restrict access using firewall rules (security groups / network ACLs)
• Whitelist only the required IP addresses

Benefits:

• Reduces operational overhead
• Avoids repeated configuration changes
• Centralizes access control

Best Practice

• Always validate changes in a non-production (lower) environment before applying to production
• Combine:
  • PostgreSQL configuration hardening
  • Network-level restrictions (firewall)

for a defense-in-depth approach