Skip to main content
Community Hub
TL;DR

Learn how to crawl AlloyDB for PostgreSQL assets and publish them to Atlan for discovery.

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

AlloyDB for PostgreSQL assets app

The AlloyDB for PostgreSQL assets app crawls AlloyDB databases, schemas, tables, views, and columns and publishes them to Atlan. Build it with the AtlanAlloydbPostgres builder, which mirrors the "new app" wizard: Credential → Connection → Metadata.

Creating an app creates a new connection

Each create mints a new connection and new assets. To re-crawl, re-run the existing workflow (see Re-run an existing app).

AlloyDB for PostgreSQL supports three authentication methods: basic (username/password), IAM user, and IAM service account. The port is optional and defaults to 5432.

Basic authentication​

AlloyDB for PostgreSQL crawling with basic auth
from pyatlan.client.atlan import AtlanClient
from pyatlan.model.apps import AtlanAlloydbPostgres

client = AtlanClient()

response = (
    AtlanAlloydbPostgres(client)
    .basic( # (1)
        username="atlan_user", # (2)
        password="••••••", # (3)
        host="203.0.113.10", # (4)
        database="postgres", # (5)
    )
    .connection( # (6)
        name="production-alloydb",
        admin_roles=[client.role_cache.get_id_for_name("$admin")],
    )
    .include_metadata({"postgres": ["analytics", "sales"]}) # (7)
    .run(name="alloydb-prod") # (8)
)
print(response.slug, response.run_id)
  1. Step 1—Credential. Username/password auth; the secret is vaulted.
  2. Required. Database username.
  3. Required. Password.
  4. Required. The IP address or hostname exposed for the AlloyDB instance. The port (port=) is optional and defaults to 5432.
  5. Required. Database to connect to.
  6. Step 2—Connection. Display name + at least one admin.
  7. Step 3—Metadata. Schemas to crawl, as {database: [schema, ...]}. Omit to crawl everything. Exclude takes priority over include.
  8. .run(name=...) creates and submits a run; use .create(name=...) to create without running.

IAM authentication​

For the IAM methods, name is the instance's connection URI from the AlloyDB instance overview (projects/<project>/locations/<region>/clusters/<cluster>/instances/<instance>). The IAM identity must also exist as a database user on the instance.

AlloyDB for PostgreSQL with IAM auth
# IAM user
AtlanAlloydbPostgres(client).iam_user(
    username="analyst@example.com", # (1)
    password="ya29.••••••", # (2)
    name="projects/my-project/locations/us-central1/clusters/my-cluster/instances/my-instance", # (3)
    database="postgres",
)

# IAM service account
AtlanAlloydbPostgres(client).iam_service_account(
    username="atlan-crawler@my-project.iam", # (4)
    password="••••••", # (5)
    name="projects/my-project/locations/us-central1/clusters/my-cluster/instances/my-instance",
    gcp_service_account='{"type": "service_account", ...}', # (6)
    database="postgres",
)
  1. Required. The IAM user's email address, without a trailing .gserviceaccount.com.
  2. Required. A short-lived access token for that user (gcloud auth print-access-token --account=<iam-user>). It expires in about an hour, so prefer a service account for scheduled workflows.
  3. Required. The instance connection URI.
  4. Required. The service account's email address, without a trailing .gserviceaccount.com.
  5. Required. The password field of the IAM service account form.
  6. Optional. The service account's JSON key, as a string. Omit it for keyless setups where the environment can obtain access tokens.

Configuration options​

All metadata options are optional—set only what you need:

AlloyDB for PostgreSQL metadata configuration
(
    AtlanAlloydbPostgres(client)
    .basic(username="atlan_user", password="••••••", host="...", database="postgres")
    .connection(name="production-alloydb", admin_roles=[...])
    .include_metadata({"postgres": ["analytics"]}) # (1)
    .exclude_metadata({"postgres": ["staging"]}) # (2)
    .exclude_regex_for_tables_views(".*_TMP|.*_TEMP|TMP.*|TEMP.*") # (3)
    .redact_sql_text(True) # (4)
    .cloud_provider("AWS") # (5)
    .run(name="alloydb-prod")
)
  1. Databases/schemas to include, as {database: [schema, ...]}.
  2. Databases/schemas to exclude—exclude takes priority over include.
  3. Regex of tables/views to ignore.
  4. Replace literal values in extracted view, function, and procedure definitions with placeholders. Off by default. See Query redaction.
  5. The cloud the Atlan tenant runs on, as the UI sets it for the same workflow.

Update existing workflows​

Publish a new version on the same slug with the builder's load() / update(). It reads the workflow's current inputs, lets you change only the fields you pass, and preserves everything else, including the connection and its credential. No run starts; the next run, manual or scheduled, uses the new version.

Turn on Redact SQL Text via the builder
(
    AtlanAlloydbPostgres(client)
    .load("atlan-alloydb-postgres-1700000000-AbC123") # (1)
    .redact_sql_text(True) # (2)
    .update()
)
  1. Seed the builder from the workflow's current inputs.
  2. Change only the fields you need; anything unset keeps its current value.

To apply one change across every AlloyDB for PostgreSQL workflow on the tenant, list workflows with client.app.get_all() and update each whose app_id is atlan-alloydb-postgres, as shown for Cloud SQL in Update existing workflows. See Manage apps for the rest of the lifecycle—list, get, run status, schedules, and delete—shared by every app.

Was this page helpful?