MIME-Version: 1.0
From: yudhi s <learnerdatabase99@gmail.com>
Date: Fri, 10 May 2024 10:03:40 +0530
Message-ID: <CAEzWdqdtbWCcSFgPAwsXPA2+6k2j0xud3mWbM=LktKp4y-ETgg@mail.gmail.com>
Subject: Question on roles and privileges
To: pgsql-general <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000de5ef90618120a30"
Archived-At: <https://www.postgresql.org/message-id/CAEzWdqdtbWCcSFgPAwsXPA2%2B6k2j0xud3mWbM%3DLktKp4y-ETgg%40mail.gmail.com>
Precedence: bulk

--000000000000de5ef90618120a30
Content-Type: text/plain; charset="UTF-8"

Hello All,
We want to make sure to keep minimal privileges for the users based on
their roles and responsibility. We have one user group who will be working
on analyzing/debugging into performance issues in the databases. Basically
this group will be operating on extensions like apg_plan_management,
pg_hint_plan, auto_explain, plprofiler, pg_repack. So these extensions will
already be installed for the group, but they will just need to use those
appropriately. For example pg_hint_plan will not need any write privilege
because the user just has to put the hint in the query and run it to see
any performance variation.

So like that , what kind of minimal privileges will each of these
extensions need to make them work for this performance group? Basically if
any of these will need write privilege or all works can be performed using
Readonly roles/privilege only?

And I understand pg_monitor role wraps up most of the key read only
privileges within it to work on performance issues and also its a readonly
privilege only. So I wanted to know from experts here , if it's true and
pg_monitor role will suffice for all the above work?

Regards
Yudhi

--000000000000de5ef90618120a30
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello All,<div>We want to make sure to keep minimal privil=
eges for the users based on their roles and responsibility. We have one use=
r group who will be working on analyzing/debugging into performance issues =
in the databases. Basically this group will be operating on extensions like=
 apg_plan_management, pg_hint_plan, auto_explain, plprofiler, pg_repack. So=
 these extensions will already be installed for the group, but they will ju=
st need to use those appropriately. For example pg_hint_plan will not need =
any write privilege because the user just has to put the hint in the query =
and run it to see any performance variation.<br><br>So like that , what kin=
d of minimal privileges will each of these extensions need to make them wor=
k for this performance group? Basically if any of these will need write pri=
vilege or all works can be performed using Readonly roles/privilege only?</=
div><div><br>And I understand pg_monitor role wraps up most of the key read=
 only privileges within it to work on performance issues and also its a rea=
donly privilege only. So I wanted to know from experts here , if it&#39;s t=
rue and pg_monitor role will suffice for all the above work?<br><div><br></=
div><div>Regards</div><div>Yudhi</div></div></div>

--000000000000de5ef90618120a30--