How to destroy Postgres databases owned by other users in RDS using Terraform?

I was able to get Terraform by creating databases and roles in RDS Postgres database, but due to limited permissions, rds_superuser

I don't see an easy way to destroy the created databases owned by another user.

Using the following configuration:

resource "postgresql_role" "app" {
  name                = "app"
  login               = true
  password            = "foo"
  skip_reassign_owned = true
}

resource "postgresql_database" "database" {
  name  = "app_database"
  owner = "${postgresql_role.app.name}"
}

      

(Required for reference skip_reassign_owned

because the group is rds_superuser

not getting the necessary permissions to reassign ownership)

results in this error:

Error applying plan:

1 error(s) occurred:

* postgresql_database.database (destroy): 1 error(s) occurred:

* postgresql_database.database: Error dropping database: pq: must be owner of database debug_db1

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

      

Using the local executor creation tools, I was able to provide the role that the database belongs to for the admin user and the application user:

resource "aws_db_instance" "database" {
  ...
}

provider "postgresql" {
  host            = "${aws_db_instance.database.address}"
  port            = 5432
  username        = "myadminuser"
  password        = "adminpassword"
  sslmode         = "require"
  connect_timeout = 15
}

resource "postgresql_role" "app" {
  name                = "app"
  login               = true
  password            = "apppassword"
  skip_reassign_owned = true
}

resource "postgresql_role" "group" {
  name                = "${postgresql_role.app.name}_group"
  skip_reassign_owned = true

  provisioner "local-exec" {
    command = "PGPASSWORD=adminpassword psql -h ${aws_db_instance.database.address} -U myadminuser postgres -c 'GRANT ${self.name} TO myadminuser, ${postgresql_role.app.name};'"
  }
}

resource "postgresql_database" "database" {
  name  = "mydatabase"
  owner = "${postgresql_role.group.name}"
}

      

which seems to work when compared to setting property rights for the app user only. I am really wondering if there is a better way I can do this without having to spit in a local exec?

+3


source to share


1 answer


After raising this question, I was able to bring up a pull request with a fix that was released in version 0.1.1 of the Postgresql provider , now it works fine on the latest version of the provider.



+1


source







All Articles