Thousands of 28000 “no pg_hba.conf entry for host” logs from Postgres - is this an attack?

Question

Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format:

sql_error_code = 28000 FATAL:  no pg_hba.conf entry for host "xx.xx.xxx.xx", user "postgres", database "postgres", SSL off

The host address is very different every time; none of the four numbers are consistent. Since "postgres" is commonly the default user and database name for Postgres, this seems like it could be be an attempt to find low-hanging fruit for data theft.

My webapp which uses the database is working fine and isn't reporting any abnormal latency, and I haven't pushed any code changes over the last week, so I'm pretty sure it's not me.

Does this follow the pattern of a hack or DDOS-like attack? If so, what's the likelihood that it's targeting my database specifically?

If it helps, the URL to my EC2 instance is not public, I've never shared it anywhere.

Answer 1

I've seen the same behavior in a few of the apps I manage. I also saw this tweet - https://twitter.com/testflyjets/status/1102410441723015168 - so I don't think these are targeted attacks, but rather an un-targeted effort to find vulnerable Postgres databases.

Most of the attempted connections were with the username "postgres", but I also saw attempts with "root", "pgsql" and "pgbouncer".