Securing a Postgres Database
I personally secure my postgres instances by putting them in a silod vpc without internet access. I then limit incoming connections to only be allowed from the separate vpc containing the application serverI then use a bastion host when I need to access ssh on the instance. The bastion host remains off and inaccessible except for when I need to perform maintenance.The advantages of this is that there is no "always-open" access to the instance.Not sure why the author does not advocate this.