> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL discovery

> Scan PostgreSQL instances for login roles and import them into PAM.

PostgreSQL discovery finds the roles that can sign in to your PostgreSQL instances, so you can import them into PAM as [PostgreSQL accounts](https://infisical.com/docs/documentation/platform/pam/accounts/postgresql.md). For how discovery works across every source type, see [Discovery](https://infisical.com/docs/documentation/platform/pam/discovery/overview).

You give the source a list of instances and one or more PostgreSQL accounts to sign in with. Infisical connects to each instance through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md).

> [accordion] How a scan works
>
> 1. Infisical checks that each instance is reachable on the ports of the source's PostgreSQL accounts, and skips the instances it can't reach
> 2. For each instance, Infisical first tries the account whose host matches the instance, then tries the other accounts until one signs in
> 3. Infisical lists the roles on the instance that can sign in, and stages each one as a PostgreSQL account for that instance
>
> If two instances each have a role named `postgres`, Infisical stages two separate accounts. If no account can sign in to an instance, the scan reports the instance and continues with the others.

## Prerequisites

* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the instances you want to scan
* One or more [PostgreSQL accounts](https://infisical.com/docs/documentation/platform/pam/accounts/postgresql.md) that authenticate with a password, to sign in to the instances with
* The [Product Admin role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership) in PAM
* The Operator or Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#folder-and-account-memberships) on those PostgreSQL accounts, because the scan sends their passwords to every instance

The PostgreSQL role that the scan signs in as only needs permission to sign in to the instance. It doesn't need to be a superuser.

A PostgreSQL account that uses AWS IAM authentication can't scan, because its sign-in token works for only one host, port, and user.

> [!WARNING]
>
> Infisical sends the PostgreSQL account's password to every instance that the source scans, so only list instances you trust.

## Step 1: Create a source

**Step 1**

Go to **Privileged Access Management** > **Discovery** and select **Add Source**.

**Step 2**

Select **PostgreSQL**, then select **Next**.

![Add Discovery Source panel with PostgreSQL selected](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pam/postgres-discovery-select-source.png)

**Step 3**

Configure the source:

| Field | Description |
| - | - |
| **Name** | A name for the source, such as `prod-databases` |
| **Credential Accounts** | The PostgreSQL accounts to sign in to the instances with |
| **Gateway** | The Gateway or Gateway pool to connect through |
| **Scan Schedule** | **Manual**, **Daily**, or **Weekly** (see [scan schedules](https://infisical.com/docs/documentation/platform/pam/discovery/overview#scan-schedules)) |
| **Targets** | The IP addresses or hostnames of the instances to scan, one per line or separated by commas (the Gateway resolves hostnames) |

Infisical connects to each instance with the port, database, and TLS settings of the PostgreSQL account it signs in with.

![PostgreSQL discovery source configuration with name, credential accounts, gateway, scan schedule, and targets fields](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pam/postgres-discovery-configure-source.png)

**Step 4**

Select **Add Source**.

## Step 2: Run a scan

On the **Discovery Sources** table, select the options menu on the source's row, then select **Scan Now**. A source can run one scan at a time.

![PostgreSQL discovery source row menu showing Scan Now](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pam/postgres-discovery-scan-now.png)

The scan stages only roles that can sign in. Roles are shared across all databases on an instance, so the database that the PostgreSQL account connects to doesn't change which roles the scan finds.

## Step 3: Import accounts

**Step 1**

On the **Discovery Sources** table, select the source.

**Step 2**

On the **Staged Accounts** tab, select the accounts you want, then select **Import Accounts**.

![Staged Accounts tab with four PostgreSQL accounts selected and the Import Accounts button](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pam/postgres-discovery-staged-accounts.png)

**Step 3**

Select a **Destination Folder** and a **PostgreSQL Template**.

![Import 4 Accounts dialog with Production as the destination folder and PostgreSQL Standard as the template](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/pam/postgres-discovery-import-accounts.png)

**Step 4**

To have Infisical set a new password on each role during the import, turn on **Rotate account passwords on import**. Then pick the **PostgreSQL Rotation Account**, which is the [rotation account](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md#rotation-accounts) that Infisical signs in as to change the passwords. By default, the field is set to one of the source's credential accounts.

A rotation account can only change passwords on its own instance (the same host and port), so Infisical imports roles from other instances without a password.

> [!WARNING]
>
> Rotation changes each role's password on its instance, so anything that signs in with the old password stops working.

**Step 5**

Select **Import**.

**Step 6**

Go to **Privileged Access Management** > **Accounts**. The scan doesn't read passwords, so each imported account that Infisical didn't rotate shows **Unavailable** until you set its password. For each of those accounts, open the options menu on its row, select **Configure**, and enter the password for its PostgreSQL role on the **Configuration** tab.

> [!TIP]
>
> Your PostgreSQL roles are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new roles it finds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.