PostgreSQL 16 + pgvector (Hardened) on Amazon Linux 2023

PostgreSQL 16 with the pgvector extension (vector similarity search for AI embeddings) on Amazon Linux 2023, security-hardened for production: minimal package set, SSH key-only access, IMDSv2-only, no password auth, and continuously patched images. This product has charges associated with it for image hardening, maintenance, and support.

View on AWS Marketplace

Why this image

• AI-ready out of the box: pgvector 0.8 compiled against PostgreSQL 16 and verified at build - exact and approximate (HNSW, IVFFlat) vector search over embeddings.
• Security-hardened at build time: minimal packages, key-only SSH, IMDSv2-only, no default database passwords, remote access closed until you configure it.
• Continuously patched: rebuilt, vulnerability-scanned, and republished on a regular cadence.

About

PostgreSQL 16 + pgvector (Hardened) on Amazon Linux 2023 is a production-ready, security-hardened image of the PostgreSQL relational database with the pgvector extension for vector similarity search - the storage layer for AI embeddings, retrieval-augmented generation (RAG), and semantic search - maintained and supported by Derek Coleman & Associates Inc.

This is repackaged open-source software. PostgreSQL is developed by the PostgreSQL Global Development Group and pgvector by its open-source community; both are distributed under the PostgreSQL License. This product bundles unmodified upstream PostgreSQL 16 with pgvector built from the upstream source tag on a hardened Amazon Linux 2023 base; the charges associated with this listing are for image hardening, continuous patching, vulnerability scanning, and business-day support - not for the underlying open-source software, which remains free.

Hardening baseline: minimal package footprint (the build toolchain is removed after compiling the extension), SSH key-only access (password authentication disabled), IMDSv2 enforced, and no default database passwords (local peer/socket auth; remote access on port 5432 stays closed until you configure pg_hba.conf and open it to trusted CIDRs). The extension load is verified at build time. Images are rebuilt, scanned for HIGH and CRITICAL vulnerabilities, and republished on a regular cadence so that new launches start current. The data directory initializes on first boot; enable the extension per database with: CREATE EXTENSION vector;

Pricing (hourly usage, AWS Marketplace)

Recommended: c7i.2xlarge. AWS infrastructure charges are separate and billed by AWS. Charges stop when instances are terminated. No subscription, no minimum.

Getting started

1. Launch from AWS Marketplace (1-Click or EC2 console).
2. Connect via SSH with your EC2 key pair: ssh -i <key> ec2-user@<public-ip>. Root login is disabled; use sudo.
3. The data directory initializes on first boot; administer locally with: sudo -u postgres psql, and enable the extension per database: CREATE EXTENSION vector;
4. Remote access (port 5432) and authentication are a deliberate customer configuration step - edit /var/lib/pgsql/data/postgresql.conf (listen_addresses) and /var/lib/pgsql/data/pg_hba.conf (add a scram-sha-256 line for your subnet), restart postgresql, then open 5432 to trusted CIDRs only. Server log: /var/lib/pgsql/data/log/.
5. Verify: sudo -u postgres psql -c 'SELECT 1;'.
6. Sensitive data: there are no passwords or secrets anywhere in this product.
7. Backup: snapshot the EBS volume (it contains all configuration and data).
8. Resources: a single instance uses 1 EC2 instance and 1 gp3 EBS volume; no other AWS resources are created.
9. Support: support@dcassociatesgroup.com.

Support

Email support@dcassociatesgroup.com — business-day response. Covers image operation, the hardening baseline, and launch issues. See support.