Skip to main content
This guide explains how to connect Coalesce Quality to Postgres securely.We need this information so we can collect metadata about your tables.To be able to finish this guide, you’ll need the following:
→ Access to modify your Postgres configuration⏱️ Estimated time to finish: 10 minutes.
Coalesce Quality uses the pg_monitor role by default, which reads/executes various monitoring views and functions. See more in the Postgres documentation. The following setup:
  1. Creates a dedicated user and user group for Coalesce Quality
  2. Grants the necessary permissions

​
Create a dedicated user with sufficient permissions

On Amazon RDS / Aurora you must run GRANT pg_monitor TO synq_group as a user that has the rds_superuser role.

​
Grant permissions to the relevant schemas

Run these for every schema you want Coalesce Quality to monitor.
ALTER DEFAULT PRIVILEGES only affects tables created by the role you name in FOR ROLE. Set "table_owner" to the role that actually creates your tables (usually your application or migration user) — otherwise synq_group will not get SELECT on tables added in the future, and newly created tables will silently stop being monitored. If several roles create tables in the schema, repeat the statement once per owner.

​
Network Configuration

Depending on your database configurations, you may need to whitelist Coalesce Quality’s IP addresses in your firewall or security groups. See IP Whitelist for the complete list of IP addresses by region.

​
Input data in the UI

​
Integration name

E.g., postgres

​
Database

The name of your Postgres database

​
Host

The name of your host, e.g., database-1.<host>.eu-north-1.rds.amazonaws.com

​
Port

The default is 5432

​
Username and password

Username and password you specified earlier in the guide

​
SSH tunnel (optional)

If your Postgres instance is only reachable through a bastion host, click Add SSH tunnel and fill in the user, hostname and port of the bastion (22 unless you run SSH elsewhere). Leave this empty for instances Coalesce Quality can reach directly. Coalesce Quality authenticates to the bastion with an RSA key pair it generates when you save the integration. Only the public half leaves the platform; it is shown under SSH tunnel key pair at the bottom of the integration’s page. Add it as a line in the ~/.ssh/authorized_keys file of the bastion user you entered. The bastion refuses the connection until that line is in place, so testing the connection before then fails.

​
Rotating the tunnel key pair

The same SSH tunnel key pair section replaces the key. This needs the Admin role. Generate a new key pair takes effect immediately, and the key it replaces keeps being offered for a week, so the tunnel carries on working while you install the new one. The section shows the previous public key and the date it stops being offered. Add the new public key to authorized_keys, then delete the line holding the previous one. Removing that line is what revokes the old key — Coalesce Quality has no access to your bastion, so a key left in the file stays usable after the week is over. Only the most recent replacement is kept, so generating a second key pair while a previous key is still being offered retires that one straight away. Finish installing one key before generating the next.