Hardened PostgreSQL-18 with pgvector on Ubuntu 24.04

This is a repackaged open source software product wherein additional charges apply for a hardened, AWS-optimized image with verifiable provenance evidence and maintenance. PostgreSQL 18 with pgvector 0.8 runs on an Ubuntu 24.04 LTS base tuned for Amazon EC2, with a documented set of security settings applied on top and a complete provenance evidence pack including a Software Bill of Materials (SBOM).

PostgreSQL 18 with pgvector 0.8 Deployment:

1. Vector Search Built In: pgvector adds vector columns, exact nearest-neighbor search and approximate indexes (HNSW and IVFFlat) inside PostgreSQL, so embeddings live next to relational data in one ACID-compliant engine.

2. Pre-Enabled in the Template Database: The extension is enabled in the template database, so every database created afterwards can store embeddings without another step.

3. Official Upstream Packaging: PostgreSQL 18 is installed from the official PGDG repository rather than a distribution backport.

Comprehensive Evidence Pack:

Every AMI carries an 8-file provenance evidence pack under /opt/optimization-report/:

• Tuning_Parameters.txt: Every tuning change, shown against its base-image value, with the reasoning and how to reverse it.
• Security_Parameters.txt: All 31 security settings in the same format; the 10 already at the wanted value are marked unchanged rather than presented as improvements.
• package_changes.txt: Packages upgraded, installed and removed versus the base image.
• sbom.spdx.json: Software Bill of Materials in SPDX format, generated from the dpkg database.
• cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan grouped by whether an upstream fix exists, so unfixable findings are not counted against the image.
• key_files.sha256: SHA-256 checksums of all 7 files this image changed, so the delivered state can be verified in one command.
• README.txt: Index of artifact contents and operational guidance.

Security & Attack Surface:

1. Kernel Network Hardening: 19 network-related kernel parameters are fixed in /etc/sysctl.d/99-security.conf: ICMP redirects are neither accepted nor sent, source-routed packets are rejected, and the rest are pinned at safe values so they cannot drift.

2. Unused Kernel Modules Disabled: 12 rarely used filesystem and network protocol modules are blocked from loading via /etc/modprobe.d/99-disable-unused.conf. squashfs stays available so snap-packaged agents keep working.

3. SSH Login Window Tightened: LoginGraceTime is reduced from 120 to 60 seconds. Root login policy, authentication retries and forwarding are left as the base image ships them.

4. Fully Patched at Release: Zero packages carried an available upstream fix at build time, including updates Ubuntu was still phasing in, and superseded kernel packages were removed rather than left behind.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, raised socket buffer ceilings, and MTU probing enabled. Ceilings are only ever raised, never lowered.

2. System Tuning: tuned daemon active with an aws-optimized profile whose bootloader section is deliberately empty, so the kernel command line carries no net.ifnames entry and the network interface keeps its original name after a reboot - verified on this instance family.

3. Reliability: The systemd journal is capped at 200 MB so logs cannot fill the root filesystem, and superseded kernels are cleaned up automatically.

Operational Tools:

1. Preinstalled Tools: AWS SSM Agent active, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream PostgreSQL and Ubuntu 24.04 security updates, with artifact documentation refreshed per release.

About PostgreSQL

One of the world's most advanced open-source relational database systems, paired here with pgvector for vector data types and similarity search. It backs transactional applications built with Django, Spring Boot, FastAPI and Node.js, and removes the need for a separate vector database in most RAG, semantic search and recommendation architectures.

About Ubuntu 24.04 LTS

The most widely deployed Linux distribution in the cloud, built on the Debian foundation, with a five-year maintenance window for LTS releases and broad ecosystem compatibility across the tooling these workloads depend on.