Description

Ensure each Render Postgres database's external access list does not contain 0.0.0.0/0, and is either empty, which blocks all external connections, or limited to approved IP ranges. Render services in the same region can still connect using the internal URL.

Rationale

By default, a Render Postgres database accepts external connections from any IP address that has valid credentials. If the password leaks, anyone on the internet could connect. Restricting external access to trusted IPs, or blocking it completely, adds a network barrier in front of the database.

Impact

  • Only approved IP ranges can connect from outside Render

  • Leaked credentials cannot be used from unknown networks

  • External tools must connect from an allowed IP

Default Value

By default, the access list contains 0.0.0.0/0, which allows external connections from any IP address.

Pre-Requisites

  • Admin or Developer role (Admin for protected environments)

  • A list of IP ranges that need external access

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Postgres database to open it.

  3. On the Info page, scroll down to the Networking section and review the allowed IP ranges.

  4. Alternatively, run: render pg get <database-name> and review the IP allow list.

  5. If the list contains 0.0.0.0/0, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Postgres database to open it.

  3. On the Info page, scroll down to the Networking section.

  4. Remove the 0.0.0.0/0 entry and add only your approved CIDR ranges, or remove all entries to block external access, then save.

  5. Alternatively, run: render pg update <database-name> --ip-allow-list "cidr=203.0.113.5/32,description=office" (or --clear-ip-allow-list to block all external access).

  6. Confirm that approved tools can still connect.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the Postgres database to open it.

  3. In the Networking section, add back the removed ranges and save.

Reference