Hardened PostgreSQL on Ubuntu 26.04 by Verified Images

This is a repackaged open source software product wherein additional charges apply for the hardened, security-maintained image (rebuilt and re-verified as new CVEs are disclosed).

Verified Images publishes a hardened, production-ready PostgreSQL database server on Ubuntu 26.04 LTS. PostgreSQL is the powerful, standards-compliant open-source relational database trusted for transactional and analytical workloads. The server is tuned and locked down at first boot, so you get a running, maintained database in minutes instead of installing and hardening PostgreSQL by hand. It is a straightforward, drop-in replacement for other self-managed PostgreSQL images.

What's included beyond a stock install:

• No baked-in credentials: on first launch the image generates a random, per-instance superuser password and a separate password for a ready-to-use application role and database. Nothing secret is stored in the AMI, and every instance is unique. Retrieve the password from the SSH login banner, from the root-only credentials file, or with "sudo pgctl info".
• Secure by construction: PostgreSQL ships bound to localhost with no password; first boot sets the password over the local socket and only then opens the network listener, so the database port never comes up unauthenticated.
• TLS by default: the server is configured for encrypted (SSL) connections out of the box; point your own certificate at it with one command when you are ready.
• A one-command operator CLI (pgctl): status, connection details, password rotation, on-demand and scheduled backups, guided restore, and enabling TLS or remote access, all in a single tool.
• Automated nightly logical backups (pg_dumpall) with rotation (last 7 kept), plus on-demand backup and guided restore.
• A hardened database baseline: scram-sha-256 password authentication, a least-privilege host-based access policy (pg_hba) that requires a password for every network connection with no "trust" rules, sensible logging defaults, and the data directory owned by an unprivileged service account under systemd.
• A hardened OS baseline (inherited from the Verified Images hardened Ubuntu 26.04 image): SSH password authentication and root login are disabled, a kernel/network sysctl hardening profile is applied, no default OS passwords or SSH keys are baked in, and automatic OS security patching (unattended-upgrades) is enabled.
• AWS Systems Manager (SSM) agent preinstalled for keyless, auditable instance management.
• Ongoing security maintenance: the hardened image is rebuilt and re-verified as new CVEs are disclosed, so new launches stay current.

PostgreSQL is distributed under the PostgreSQL License, a permissive open-source license in the BSD/MIT family that allows commercial use, modification, and redistribution; it is not a source-available or resale-restricted license. PostgreSQL is a trademark of the PostgreSQL Community Association of Canada; Verified Images is an independent repackager and is not affiliated with, sponsored by, or endorsed by the PostgreSQL project.