Re: Question on roles and privileges

public inbox for [email protected]  
help / color / mirror / Atom feed

From: Lok P <[email protected]>
To: yudhi s <[email protected]>
Cc: pgsql-general <[email protected]>
Subject: Re: Question on roles and privileges
Date: Fri, 10 May 2024 11:31:00 +0530
Message-ID: <CAKna9VY1+05VziBGD64SJeHGO-FPZc861z13C=JibfG2c+t_bQ@mail.gmail.com> (raw)
In-Reply-To: <CAEzWdqdtbWCcSFgPAwsXPA2+6k2j0xud3mWbM=LktKp4y-ETgg@mail.gmail.com>
References: <CAEzWdqdtbWCcSFgPAwsXPA2+6k2j0xud3mWbM=LktKp4y-ETgg@mail.gmail.com>

For the initial installation the extensions may need superuser privileges.

On Fri, May 10, 2024 at 10:04 AM yudhi s <[email protected]>
wrote:

> Hello All,
> We want to make sure to keep minimal privileges for the users based on
> their roles and responsibility. We have one user group who will be working
> on analyzing/debugging into performance issues in the databases. Basically
> this group will be operating on extensions like apg_plan_management,
> pg_hint_plan, auto_explain, plprofiler, pg_repack. So these extensions will
> already be installed for the group, but they will just need to use those
> appropriately. For example pg_hint_plan will not need any write privilege
> because the user just has to put the hint in the query and run it to see
> any performance variation.
>
> So like that , what kind of minimal privileges will each of these
> extensions need to make them work for this performance group? Basically if
> any of these will need write privilege or all works can be performed using
> Readonly roles/privilege only?
>
> And I understand pg_monitor role wraps up most of the key read only
> privileges within it to work on performance issues and also its a readonly
> privilege only. So I wanted to know from experts here , if it's true and
> pg_monitor role will suffice for all the above work?
>
> Regards
> Yudhi
>

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: Question on roles and privileges
  In-Reply-To: <CAKna9VY1+05VziBGD64SJeHGO-FPZc861z13C=JibfG2c+t_bQ@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox