## Set up PostgreSQL

URL: https://docs.atlan.com/apps/connectors/database/postgresql/how-tos/set-up-postgresql

> :::warning Who can do this? You will probably need your PostgreSQL administrator to run these commands - you may not have access yourself.

:::warning Who can do this?
 You will probably need your PostgreSQL administrator to run these commands - you may not have access yourself.

:::

## Create a database role

To configure a database role for PostgreSQL, run the following commands:

```sql
CREATE role atlan_user_role;
GRANT USAGE ON SCHEMA <schema> TO atlan_user_role;
```

- Replace `<schema>` with the schema to which the user should have access.

:::warning

You (or your administrator) will need to run these statements for each database and schema you want to crawl.

:::

Atlan requires the following privileges:

- `USAGE`:
 - Access a schema and fetch metadata. By default, users cannot access any objects in schemas that they do not own. The owner of a schema must grant the `USAGE` privilege on the schema to allow access.
 - Fetch the technical metadata persisted in the `INFORMATION_SCHEMA`.

These permissions enables Atlan to crawl metadat from PostgreSQL.

## (Optional) Grant permissions to query and preview data

To grant permissions to query data and preview sample data:

 ```sql
 GRANT SELECT, REFERENCES ON ALL TABLES IN SCHEMA schema_name TO atlan_user_role;
 ```
 - Replace `schema_name`: Name of the schema you want Atlan to access.
 - Replace `atlan_user_role`: Role assigned to Atlan in your database.

The`SELECT` privilege is required to preview and query data from within Atlan.

## Choose authentication mechanism

Atlan currently supports the following authentication mechanisms. You will need to choose one and configure it according to the steps below.

- [Basic authentication](#basic-authentication)
- [Identity and Access Management (IAM) authentication](#identity-and-access-management-iam-authentication)

## Basic authentication

To create a username and password for basic authentication for PostgreSQL run the following commands:

```sql
CREATE USER atlan_user password '<pass>';
GRANT atlan_user_role TO atlan_user;
```

- Replace `<pass>` with the password for the `atlan_user` user you are creating.

## Identity and Access Management (IAM) authentication

To configure IAM authentication for PostgreSQL follow each of these steps.

### Enable IAM authentication

To enable IAM authentication for your database instance follow [the steps in the Amazon RDS documentation](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html).

When given the option, apply the changes immediately and wait until they are complete.

### Create database user

To create a database user with the necessary permissions run the following commands:

1. Connect to the database: 

 ```
 psql -h {{endpoint}} -U {{username}} -d {{database}}
 ```

 - Replace `{{endpoint}}` with the database or cluster endpoint.
 - Replace `{{username}}` with the master username (admin account) for the database.
 - Replace `{{database}}` with the name of the database.
2. Create a database user: 

 ```sql
 CREATE USER {{db-username}} WITH LOGIN; 
 GRANT atlan_user_role, rds_iam TO {{db-username}};
 ```

 - Replace `{{db-username}}` with the name for the database user to create.

### Create IAM policy

To create an IAM policy with the necessary permissions follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html).

Create the policy using the following JSON:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "rds-db:connect"
 ],
 "Resource": [
 "arn:aws:rds-db:{{aws-region}}:{{account-id}}:dbuser:{{resource-id}}/{{db-username}}"
 ]
 }
 ]
}
```

- Replace `{{aws-region}}` with the AWS region of your database instance.
- Replace `{{account-id}}` with your account ID.
- Replace `{{resource-id}}` with the resource ID.
- Replace `{{db-username}}` with the username created in the previous step.

### Attach IAM policy

To attach the IAM policy for Atlan's use, you have two options:

- **IAM role**: Create a new role in your AWS account and attach the policy to this role. To create an AWS IAM role:
 1. Follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
 2. When prompted for policies, attach the policy created in the previous step to this role.
 3. [Raise a support ticket](https://docs.atlan.com/support/submit-request) to provide the AWS IAM role ARN to Atlan and get the ARN of the _Node Instance Role_ for your Atlan EKS cluster from Atlan.
 4. When prompted, create a trust relationship for the role using the following trust policy. (Replace `<atlan_nodeinstance_role_arn>` with the ARN received from Atlan support.) 

 ```json
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {"AWS": "<atlan_nodeinstance_role_arn>"},
 "Action": "sts:AssumeRole",
 }
 ]
 }
 ```

- **IAM user**: Create an AWS IAM user and attach the policy to this user. To create an AWS IAM user:
 1. Follow [the steps in the AWS Identity and Access Management User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html).
 2. On the _Set permissions_ page, attach the policy created in the previous step to this user.
 3. Once the user is created, view or download the user's _access key ID_ and _secret access key_.

 :::warning

 This will be your only opportunity to view or download the access keys. You will not have access to them again after leaving the user creation screen.

 :::

---