Best practices for securing your AlloyDB for PostgreSQL resources

To help you achieve a strong security posture for your AlloyDB for PostgreSQL resources, follow the best practices provided in this page.

Prevent search path hijacking

To prevent search path hijacking , make sure that highly privileged users have the search_path parameter set to pg_catalog . This makes sure that the search path is secured and that untrusted schemas like public are bypassed.

To set this parameter permanently for a user, run the following command:

  ALTER 
  
 ROLE 
  
  USER_NAME 
 
  
 SET 
  
 search_path 
  
 = 
  
 pg_catalog 
 , 
 pg_temp 
 ; 
 

To set this parameter only for the current session, run the following command:

  SET 
  
 search_path 
  
 TO 
  
 pg_catalog 
 , 
 pg_temp 
 ; 
 

To set this parameter for all users when connected to a database, run the following command:

  ALTER 
  
 DATABASE 
  
  DB_NAME 
 
  
 SET 
  
 search_path 
  
 TO 
  
 schema1 
 , 
  
 schema2 
 , 
  
 public 
 ; 
 

For more information, see the PostgreSQL documentation on secure schema usage and the CVE-2018-1058 guide .