Blog

Giving developers a path to a Postgres instance with no public IP, without a self-managed bastion anyone logs into and without standing up a VPN. Uses GCP Identity-Aware Proxy TCP forwarding to a headless relay VM that runs one socat process and nothing else, no SSH keys, no OS Login, IAM gates the tunnel instead of a login. Covers the network layer and the separate, non-optional step after it: Postgres-level group authentication and privilege grants, since reaching the instance is not the same as being able to query it.

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.