通过Terrafrom的授予特权和权限不起作用

发布于 2025-01-27 11:29:23 字数 855 浏览 5 评论 0 原文

根据Terraform Doc的说法，我创建了一个用户和角色，如下所示：

resource "postgresql_role" "ro_role" {
  name     = "ro_role"
}

resource "postgresql_role" "ro_user" {
  name     = "ro_user"
  login    = true
  password = "some sensitive password"
}

它是成功创建的。接下来，当尝试掌握角色的权限时，例如，仅添加的Readonly角色，它根本不会添加任何特权。另外，当登录到Postgres并尝试选择查询时，它会给我一个权限拒绝错误。

resource "postgresql_grant" "readonly_tables" {
  database    = var.database
  role        = "ro_role"
  schema      = "public"
  object_type = "table"
  objects     = []
  privileges  = ["SELECT"]
}

Terraform Doc获得授予许可：

原文

according to terraform doc, I created a user and role as follows:

resource "postgresql_role" "ro_role" {
  name     = "ro_role"
}

resource "postgresql_role" "ro_user" {
  name     = "ro_user"
  login    = true
  password = "some sensitive password"
}

which is successfully created.
next, when trying to grand permissions to a role, such as for a readonly role adding SELECT only, it does not add any privileges at all. Also when login to Postgres and trying SELECT query, it gives me a permission denied error.

resource "postgresql_grant" "readonly_tables" {
  database    = var.database
  role        = "ro_role"
  schema      = "public"
  object_type = "table"
  objects     = []
  privileges  = ["SELECT"]
}

terraform doc for grant permission:
https://registry.terraform.io/providers/cyrilgdn/postgresql/latest/docs/resources/postgresql_grant

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

风柔一江水 2025-02-03 11:29:24

您可能没有在公共架构上授予自己使用。根据您提供的文档，您需要定义一个资源，例如：

resource "postgresql_grant" "readonly_tables_schema_usage_public" {
  database    = var.database
  role        = "ro_role"
  schema      = "public"
  object_type = "schema"
  objects     = ["public]
  privileges  = ["USAGE"]
}

postgresql_role.ro_user资源也没有掩盖ro_role。您将需要此功能，使RO_USER实际上将权限分配给RO_ROLE：

resource "postgresql_role" "ro_user" {
  name     = "ro_user"
  login    = true
  password = "some sensitive password",
  roles=[postgresql_role.ro_role.role]
}

You likely didn't grant yourself USAGE on the public schema. Based on the docs you provided, you'll need to define a resource like:

resource "postgresql_grant" "readonly_tables_schema_usage_public" {
  database    = var.database
  role        = "ro_role"
  schema      = "public"
  object_type = "schema"
  objects     = ["public]
  privileges  = ["USAGE"]
}

the postgresql_role.ro_user resources is also not assinged the ro_role. You will need this for ro_user to actually have the permissions assigned to ro_role:

resource "postgresql_role" "ro_user" {
  name     = "ro_user"
  login    = true
  password = "some sensitive password",
  roles=[postgresql_role.ro_role.role]
}

回复收藏 0 原文

~没有更多了~