Security best practices
Security recommendations for CARTO Self-Hosted
Last updated
Was this helpful?
Security recommendations for CARTO Self-Hosted
Follow these best practices to harden your CARTO Self-Hosted installation.
Enforce TLS 1.2 or higher, and disable TLS 1.0 and 1.1 on your load balancer and ingress controller
Use strong cipher suites
Automate certificate renewal using cert-manager + Let's Encrypt, or your cloud provider's managed certificate service. Do not rely on manual certificate renewal processes
Rotate secrets regularly — see the Key rotation schedule section below
Never commit carto-secrets.yaml to version control. Use .gitignore and store the file in your secrets manager.
Apply Kubernetes NetworkPolicies to restrict pod-to-pod traffic:
CARTO pods should only accept traffic from within the CARTO namespace and from the ingress controller
PostgreSQL should only accept connections from the CARTO namespace CIDR
Valkey should only accept connections from the CARTO namespace
Use private cluster networking — no public node IPs; all inbound traffic through the load balancer only
If connecting to managed database or cache services, use private endpoints (VPC peering, Private Service Connect, PrivateLink, Private Endpoint) to avoid traffic traversing the public internet
Use cloud-native workload identity instead of long-lived keys:
GCP
Workload Identity
CARTO pods authenticate as a GCP service account without key files
AWS
EKS Pod Identity
CARTO pods assume an IAM role without access keys
See the configuration guides in the Security configuration section for setup instructions.
Restrict Admin Console access (Kots):
Change the default Admin Console password immediately after the first login
Limit network access to the Admin Console port to your operations team's IP range
PostgreSQL database credentials
Every 90 days
Update in your secrets store; restart CARTO pods to pick up the new credentials
Object storage service account keys
Every 90 days (if using key-based auth)
Prefer Workload Identity / IRSA / Managed Identity to eliminate key rotation
TLS certificates
Per certificate validity (typically 90 days for Let's Encrypt, 1 year for commercial CAs)
Automate with cert-manager
CARTO license credentials
On renewal (before expiry)
Apply updated carto-secrets.yaml or Kots license file
Last updated
Was this helpful?
Was this helpful?
