Row-Level Security in Postgres: Strong Defense, Costs You Will Encounter
RLS pushes access control into the database. It is more secure than application-side filters and slightly slower than no filter at all. Here is the framework for using it well.
Notes for the problems that show up after launch: bad plans, awkward migrations, index debt, vacuum pressure, replica lag, and the small decisions that make PostgreSQL easier to operate.
RLS pushes access control into the database. It is more secure than application-side filters and slightly slower than no filter at all. Here is the framework for using it well.
SSL on Postgres is a one-line config change to enable and a multi-day project to do correctly. The default settings are not good enough.
"Did anyone read the customer table outside expected hours" is a common audit question. The answer is harder to produce than it should be unless you set up auditing deliberately.
Most Postgres connection strings live in places they should not. Environment variables, config files, scripts, screenshots in Slack. Here is the discipline.
RDS exposes hundreds of Postgres parameters through Parameter Groups. About a dozen of them are worth tuning. Here are the ones I always change and why.
Aurora's replica lag has different mechanics than vanilla streaming replication. The dashboard metric "replica lag" can be misleading. Here is what it actually measures.
Lock incidents feel mysterious because the database looks idle while requests wait. The fix starts with blockers, waiters, transaction age, and code paths that take locks in different orders.
Cloud SQL maintenance windows are mostly fine and occasionally not. Here is what happens during them, what gets restarted, and how to make sure your application survives.
Azure Flex's defaults are conservative. The Server parameters blade is where most of the meaningful tuning happens. Here are the parameters I always touch.
Postgres on Kubernetes is feasible now in a way it was not five years ago. The operators are mature, the storage is good enough, and the failure modes are tractable. Here is what to know.
N+1 is the most common ORM-induced performance bug. The query count tells the story; the application code makes it impossible to spot at review time.
Prepared statements skip the planning step on repeated execution. Sometimes that is a 5x speedup. Sometimes it is a 50x slowdown. Knowing the difference matters.