Connecting
Internet access, the allowlist, and the connection URL
A new database is closed
Nothing outside the cluster can reach a new database. There is no endpoint, no hostname, and no way in until you turn internet access on.
That is deliberate. A database that is reachable the moment it exists is a database that can be found before you have finished setting it up.
The allowlist
Turning internet access on requires naming the source ranges that may connect, in CIDR notation.
| You want to allow | You write |
|---|---|
| One address | 203.0.113.7/32 |
| A range | 203.0.113.0/24 |
| Anywhere | 0.0.0.0/0 |
Two rules are worth knowing.
The list is the whole allowlist, not an addition to one. Saving a shorter list revokes the ranges you left out.
An empty list is refused rather than read as permitting everyone. An empty list is
indistinguishable from one nobody filled in, and the safe reading of that is not the one that
publishes a database to the internet. If you genuinely want no restriction, write 0.0.0.0/0, which
is a decision someone can see in the console and question.
Ranges are normalised when they are saved: host bits are cleared, duplicates dropped, and the result
sorted. 203.0.113.7/24 is stored as 203.0.113.0/24.
The endpoint
Once access is on, the cluster creates an endpoint. This takes a short while, and until it exists the hostname is empty, which the console says rather than showing a name that does not resolve yet.
The endpoint answers on PostgreSQL's own port, 5432.
The connection URL
Each app user has its own connection URL, because the credentials in it belong to that user. You will find it on the user's page, under Connect with this user:
postgresql://USER:PASSWORD@HOST:5432/DATABASEEverything but the password is on screen, so you can check the host and the database without revealing a secret. Copying takes the real URL, password included, whether or not it is revealed.
A password containing characters that are not URL safe is escaped in the copied URL. Building the URL by hand from a revealed password is the common way to get an authentication failure that looks like a wrong password.
Turning access off
Turning internet access off withdraws the route and the allowlist and leaves the database itself untouched, so it is a safe thing to do in a hurry. Anything connecting from outside stops immediately.