From: M Sarwar <sarwarmd02@outlook.com>
To: Edwin UY <edwin.uy@gmail.com>
To: Norbert Poellmann <np@ibu.de>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: RE: GRANT CONNECT ON DATABASE
Date: Mon, 10 Jun 2024 12:44:29 +0000
Message-ID: <DM4PR19MB597871C16367EC841DDC943FD3C62@DM4PR19MB5978.namprd19.prod.outlook.com> (raw)
In-Reply-To: <CA+wokJ-EL6e65Y=++QDFuvyoPdvN=Kc9JXOu+uDeC6JwoaQjaQ@mail.gmail.com>
References: <CA+wokJ8-z3sXJbrWHoxEVa2dV2Qsp2OyqyzdJBa3rvhWOEyXOg@mail.gmail.com>
<ZmbcriGHk23NPkMN@mail.ibu.de>
<CA+wokJ-EL6e65Y=++QDFuvyoPdvN=Kc9JXOu+uDeC6JwoaQjaQ@mail.gmail.com>
We are using aws - rds.
All the discussions with respect to this thread are applicable to aws rds.
Thanks,
Sarwar
Sent from my Galaxy
-------- Original message --------
From: Edwin UY <edwin.uy@gmail.com>
Date: 6/10/24 8:18 AM (GMT-05:00)
To: Norbert Poellmann <np@ibu.de>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: GRANT CONNECT ON DATABASE
Don't think I can do this as this is AWS RDS?
On Mon, Jun 10, 2024 at 10:59 PM Norbert Poellmann <np@ibu.de<mailto:np@ibu.de>> wrote:
On Mon, Jun 10, 2024 at 12:09:14PM +1200, Edwin UY wrote:
> Hi,
>
> A role was created as below:
> CREATE ROLE [blah] WITH NOLOGIN NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE
> NOREPLICATION VALID UNTIL 'infinity';
>
> Doesn't the following SQLs supposed to give the role login access?
>
> ALTER ROLE [blah] WITH ENCRYPTED PASSWORD 'blahpassword' ;
> GRANT CONNECT ON DATABASE [blahdb] TO [blahuser] ;
>
> We're trying to take the minimalist approach for a user access to have
> access to only the tables he has created and only to a specific database
> and schema.
Hi,
I would suggest, additionally, the strictest doorman for your database
is a record in ${data_directory}/pg_hba.conf, example:
# TYPE DATABASE USER ADDRESS METHOD
hostssl blahdb blahuser 1.2.3.4/32<http://1.2.3.4/32; scram-sha-256
changes followed by a server reload.
cheers
Norbert Poellmann
>
> Regards,
> Ed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sarwarmd02@outlook.com, edwin.uy@gmail.com, np@ibu.de, pgsql-admin@lists.postgresql.org
Subject: RE: GRANT CONNECT ON DATABASE
In-Reply-To: <DM4PR19MB597871C16367EC841DDC943FD3C62@DM4PR19MB5978.namprd19.prod.outlook.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox