provider/postgres grant role when creating database

[pbthorste]

The code here is reintroduced from older commits. See:

2e52914

and

f3add9e

(the part related to grantRoleMembership).

Without this code - creating a new database with a terraform generated role as the owner will not work. You will get the error:

Error applying plan:

1 error(s) occurred:

* postgresql_database.my-db: Error creating database database1: pq: must be member of role "my-role"

[pbthorste]

Another issue that this commit fixes: Roles cannot be destroyed after they are created. Error is:

Error applying plan:

1 error(s) occurred:

* postgresql_role.my-role: Error deleting role: pq: permission denied to reassign objects

[martynsmith]

This is definitely an issue with AWS RDS, any idea if/when it'll be merged?

[pbthorste]

hopefully soon. There is a workaround - but then you have to manually log into the postgres instance and grant the role.

[mindw]

@pbthorste can it be done from provisioner? do you have a code example handy?

Thanks!

[pbthorste]

@mindw No, it is a manual operation - I'll try to explain the steps :)

1. Create db / use a provider
   If you create a postgres database with "aws_db_instance", you have a username
   which is usually the same one as the one used in the postgresql provider. Lets
   call that user: 'provider_user' (this user is not a superuser)

2. Create a role
   Then you create a new role with 'postgresql_role' - lets call that 'new_role'.

3. Create a database
   This will fail: you can't then create a database with postgresql_database where the owner is the 'new_role'.

That is until you log into your postgres instance and run:

GRANT new_role to provider_user;

after this granting has taken place, you can run terraform and the db will be created.

[FlorinAndrei]

Without this PR the Postgresql provider in Terraform is broken if you use RDS. Please merge.

[mindw]

Any news on this one?
Thanks!

[grubernaut]

LGTM, thanks

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.