Securing a Postgres Database
I personally secure my postgres instances by putting them in a silod vpc without internet access. I then limit incoming connections to only be allowed from the separate vpc containing the application server<p>I then use a bastion host when I need to access ssh on the instance. The bastion host remains off and inaccessible except for when I need to perform maintenance.<p>The advantages of this is that there is no "always-open" access to the instance.<p>Not sure why the author does not advocate this.