# Ensure Postgres databases are not accessible from the entire internet

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876667518686-ensure-postgres-databases-are-not-accessible-from-the-entire-internet
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Render Postgres database's external access list does not contain 0.0.0.0/0, and is either empty, which blocks all external connections, or limited to approved IP ranges. Render services in the same region can still connect using the internal URL.

**Rationale**

By default, a Render Postgres database accepts external connections from any IP address that has valid credentials. If the password leaks, anyone on the internet could connect. Restricting external access to trusted IPs, or blocking it completely, adds a network barrier in front of the database.

**Impact**

-   Only approved IP ranges can connect from outside Render
    
-   Leaked credentials cannot be used from unknown networks
    
-   External tools must connect from an allowed IP
    

**Default Value**

By default, the access list contains 0.0.0.0/0, which allows external connections from any IP address.

**Pre-Requisites**

-   Admin or Developer role (Admin for protected environments)
    
-   A list of IP ranges that need external access
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Postgres database to open it.
    
3.  On the Info page, scroll down to the Networking section and review the allowed IP ranges.
    
4.  Alternatively, run: render pg get <database-name> and review the IP allow list.
    
5.  If the list contains 0.0.0.0/0, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Postgres database to open it.
    
3.  On the Info page, scroll down to the Networking section.
    
4.  Remove the 0.0.0.0/0 entry and add only your approved CIDR ranges, or remove all entries to block external access, then save.
    
5.  Alternatively, run: render pg update <database-name> --ip-allow-list "cidr=203.0.113.5/32,description=office" (or --clear-ip-allow-list to block all external access).
    
6.  Confirm that approved tools can still connect.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the Postgres database to open it.
    
3.  In the Networking section, add back the removed ranges and save.
    

**Reference**

-   [https://render.com/docs/postgresql-creating-connecting](https://render.com/docs/postgresql-creating-connecting)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.