MIME-Version: 1.0
References: <CAEzWdqdtbWCcSFgPAwsXPA2+6k2j0xud3mWbM=LktKp4y-ETgg@mail.gmail.com>
In-Reply-To: <CAEzWdqdtbWCcSFgPAwsXPA2+6k2j0xud3mWbM=LktKp4y-ETgg@mail.gmail.com>
From: Lok P <loknath.73@gmail.com>
Date: Fri, 10 May 2024 11:31:00 +0530
Message-ID: <CAKna9VY1+05VziBGD64SJeHGO-FPZc861z13C=JibfG2c+t_bQ@mail.gmail.com>
Subject: Re: Question on roles and privileges
To: yudhi s <learnerdatabase99@gmail.com>
Cc: pgsql-general <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000421d79061813439f"
Archived-At: <https://www.postgresql.org/message-id/CAKna9VY1%2B05VziBGD64SJeHGO-FPZc861z13C%3DJibfG2c%2Bt_bQ%40mail.gmail.com>
Precedence: bulk

--000000000000421d79061813439f
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

For the initial installation the extensions may need superuser privileges.

On Fri, May 10, 2024 at 10:04=E2=80=AFAM yudhi s <learnerdatabase99@gmail.c=
om>
wrote:

> Hello All,
> We want to make sure to keep minimal privileges for the users based on
> their roles and responsibility. We have one user group who will be workin=
g
> on analyzing/debugging into performance issues in the databases. Basicall=
y
> this group will be operating on extensions like apg_plan_management,
> pg_hint_plan, auto_explain, plprofiler, pg_repack. So these extensions wi=
ll
> already be installed for the group, but they will just need to use those
> appropriately. For example pg_hint_plan will not need any write privilege
> because the user just has to put the hint in the query and run it to see
> any performance variation.
>
> So like that , what kind of minimal privileges will each of these
> extensions need to make them work for this performance group? Basically i=
f
> any of these will need write privilege or all works can be performed usin=
g
> Readonly roles/privilege only?
>
> And I understand pg_monitor role wraps up most of the key read only
> privileges within it to work on performance issues and also its a readonl=
y
> privilege only. So I wanted to know from experts here , if it's true and
> pg_monitor role will suffice for all the above work?
>
> Regards
> Yudhi
>

--000000000000421d79061813439f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">For the initial installation the extensions may need super=
user privileges.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=
=3D"gmail_attr">On Fri, May 10, 2024 at 10:04=E2=80=AFAM yudhi s &lt;<a hre=
f=3D"mailto:learnerdatabase99@gmail.com">learnerdatabase99@gmail.com</a>&gt=
; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px=
 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div di=
r=3D"ltr">Hello All,<div>We want to make sure to keep minimal privileges fo=
r the users based on their roles and responsibility. We have one user group=
 who will be working on analyzing/debugging into performance issues in the =
databases. Basically this group will be operating on extensions like apg_pl=
an_management, pg_hint_plan, auto_explain, plprofiler, pg_repack. So these =
extensions will already be installed for the group, but they will just need=
 to use those appropriately. For example pg_hint_plan will not need any wri=
te privilege because the user just has to put the hint in the query and run=
 it to see any performance variation.<br><br>So like that , what kind of mi=
nimal privileges will each of these extensions need to make them work for t=
his performance group? Basically if any of these will need write privilege =
or all works can be performed using Readonly roles/privilege only?</div><di=
v><br>And I understand pg_monitor role wraps up most of the key read only p=
rivileges within it to work on performance issues and also its a readonly p=
rivilege only. So I wanted to know from experts here , if it&#39;s true and=
 pg_monitor role will suffice for all the above work?<br><div><br></div><di=
v>Regards</div><div>Yudhi</div></div></div>
</blockquote></div>

--000000000000421d79061813439f--