Remove old docs. Update docs and code to support the PUBLIC role.
This commit is contained in:
parent
c3a3ddc0f5
commit
73be4bc21f
|
@ -79,8 +79,9 @@ func resourcePostgreSQLSchema() *schema.Resource {
|
||||||
schemaPolicyRoleAttr: {
|
schemaPolicyRoleAttr: {
|
||||||
Type: schema.TypeString,
|
Type: schema.TypeString,
|
||||||
Elem: &schema.Schema{Type: schema.TypeString},
|
Elem: &schema.Schema{Type: schema.TypeString},
|
||||||
Required: true,
|
Optional: true,
|
||||||
Description: "ROLE who will receive this policy",
|
Default: "",
|
||||||
|
Description: "ROLE who will receive this policy (default: PUBLIC)",
|
||||||
},
|
},
|
||||||
schemaPolicyUsageAttr: {
|
schemaPolicyUsageAttr: {
|
||||||
Type: schema.TypeBool,
|
Type: schema.TypeBool,
|
||||||
|
@ -351,6 +352,9 @@ func setSchemaPolicy(txn *sql.Tx, d *schema.ResourceData) error {
|
||||||
pMap := p.(map[string]interface{})
|
pMap := p.(map[string]interface{})
|
||||||
rolePolicy := schemaPolicyToACL(pMap)
|
rolePolicy := schemaPolicyToACL(pMap)
|
||||||
|
|
||||||
|
// The PUBLIC role can not be DROP'ed, therefore we do not need
|
||||||
|
// to prevent revoking against it not existing.
|
||||||
|
if rolePolicy.Role != "" {
|
||||||
var foundUser bool
|
var foundUser bool
|
||||||
err := txn.QueryRow(`SELECT TRUE FROM pg_catalog.pg_user WHERE usename = $1`, rolePolicy.Role).Scan(&foundUser)
|
err := txn.QueryRow(`SELECT TRUE FROM pg_catalog.pg_user WHERE usename = $1`, rolePolicy.Role).Scan(&foundUser)
|
||||||
switch {
|
switch {
|
||||||
|
@ -363,6 +367,7 @@ func setSchemaPolicy(txn *sql.Tx, d *schema.ResourceData) error {
|
||||||
queries = append(queries, rolePolicy.Revokes(schemaName)...)
|
queries = append(queries, rolePolicy.Revokes(schemaName)...)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
for _, p := range added {
|
for _, p := range added {
|
||||||
pMap := p.(map[string]interface{})
|
pMap := p.(map[string]interface{})
|
||||||
|
|
|
@ -8,16 +8,48 @@ description: |-
|
||||||
|
|
||||||
# postgresql\_schema
|
# postgresql\_schema
|
||||||
|
|
||||||
The ``postgresql_schema`` resource creates and manages a schema within a
|
The ``postgresql_schema`` resource creates and manages a [schema
|
||||||
PostgreSQL database.
|
objects](https://www.postgresql.org/docs/current/static/ddl-schemas.html) within
|
||||||
|
a PostgreSQL database.
|
||||||
|
|
||||||
|
|
||||||
## Usage
|
## Usage
|
||||||
|
|
||||||
```
|
```
|
||||||
|
resource "postgresql_role" "app_www" {
|
||||||
|
name = "app_www"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "postgresql_role" "app_dba" {
|
||||||
|
name = "app_dba"
|
||||||
|
}
|
||||||
|
|
||||||
|
resource "postgresql_role" "app_releng" {
|
||||||
|
name = "app_releng"
|
||||||
|
}
|
||||||
|
|
||||||
resource "postgresql_schema" "my_schema" {
|
resource "postgresql_schema" "my_schema" {
|
||||||
name = "my_schema"
|
name = "my_schema"
|
||||||
owner = "postgres"
|
owner = "postgres"
|
||||||
|
|
||||||
|
policy {
|
||||||
|
usage = true
|
||||||
|
role = "${postgresql_role.app_www.name}"
|
||||||
|
}
|
||||||
|
|
||||||
|
# app_releng can create new objects in the schema. This is the role that
|
||||||
|
# migrations are executed as.
|
||||||
|
policy {
|
||||||
|
create = true
|
||||||
|
usage = true
|
||||||
|
role = "${postgresql_role.app_releng.name}"
|
||||||
|
}
|
||||||
|
|
||||||
|
policy {
|
||||||
|
create_with_grant = true
|
||||||
|
usage_with_grant = true
|
||||||
|
role = "${postgresql_role.app_dba.name}"
|
||||||
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
|
@ -25,8 +57,19 @@ resource "postgresql_schema" "my_schema" {
|
||||||
|
|
||||||
* `name` - (Required) The name of the schema. Must be unique in the PostgreSQL
|
* `name` - (Required) The name of the schema. Must be unique in the PostgreSQL
|
||||||
database instance where it is configured.
|
database instance where it is configured.
|
||||||
|
|
||||||
* `owner` - (Optional) The ROLE who owns the schema.
|
* `owner` - (Optional) The ROLE who owns the schema.
|
||||||
|
* `policy` - (Optional) Can be specified multiple times for each policy. Each
|
||||||
|
policy block supports fields documented below.
|
||||||
|
|
||||||
|
The `policy` block supports:
|
||||||
|
|
||||||
|
* `create` - (Optional) Should the specified ROLE have CREATE privileges to the specified SCHEMA.
|
||||||
|
* `create_with_grant` - (Optional) Should the specified ROLE have CREATE privileges to the specified SCHEMA and the ability to GRANT the CREATE privilege to other ROLEs.
|
||||||
|
* `role` - (Optional) The ROLE who is receiving the policy. If this value is empty or not specified it implies the policy is referring to the [`PUBLIC` role](https://www.postgresql.org/docs/current/static/sql-grant.html).
|
||||||
|
* `usage` - (Optional) Should the specified ROLE have USAGE privileges to the specified SCHEMA.
|
||||||
|
* `usage_with_grant` - (Optional) Should the specified ROLE have USAGE privileges to the specified SCHEMA and the ability to GRANT the USAGE privilege to other ROLEs.
|
||||||
|
|
||||||
|
~> **NOTE on `policy`:** The permissions of a role specified in multiple policy blocks is cumulative. For example, if the same role is specified in two different `policy` each with different permissions (e.g. `create` and `usage_with_grant`, respectively), then the specified role with have both `create` and `usage_with_grant` privileges.
|
||||||
|
|
||||||
## Import Example
|
## Import Example
|
||||||
|
|
||||||
|
@ -41,6 +84,10 @@ resource "postgresql_schema" "public" {
|
||||||
resource "postgresql_schema" "schema_foo" {
|
resource "postgresql_schema" "schema_foo" {
|
||||||
name = "my_schema"
|
name = "my_schema"
|
||||||
owner = "postgres"
|
owner = "postgres"
|
||||||
|
|
||||||
|
policy {
|
||||||
|
usage = true
|
||||||
|
}
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
|
@ -1,76 +0,0 @@
|
||||||
---
|
|
||||||
layout: "postgresql"
|
|
||||||
page_title: "PostgreSQL: postgresql_schema_policy"
|
|
||||||
sidebar_current: "docs-postgresql-resource-postgresql_schema_policy"
|
|
||||||
description: |-
|
|
||||||
Manages the permissions of PostgreSQL schemas.
|
|
||||||
---
|
|
||||||
|
|
||||||
# postgresql\_schema\_policy
|
|
||||||
|
|
||||||
The ``postgresql_schema_policy`` resource applies the necessary SQL DCL
|
|
||||||
(`GRANT`s and `REVOKE`s) necessary to ensure access compliance to a particular
|
|
||||||
SCHEMA within a PostgreSQL database.
|
|
||||||
|
|
||||||
|
|
||||||
## Usage
|
|
||||||
|
|
||||||
```
|
|
||||||
resource "postgresql_role" "my_app" {
|
|
||||||
name = "my_app"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "postgresql_schema" "my_schema" {
|
|
||||||
name = "my_schema"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "postgresql_schema_policy" "my_schema" {
|
|
||||||
create = true
|
|
||||||
usage = true
|
|
||||||
schema = "${postgresql_schema.my_schema.name}"
|
|
||||||
role = "${postgresql_role.my_app.name}"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
## Argument Reference
|
|
||||||
|
|
||||||
* `create` - (Optional) Should the specified ROLE have CREATE privileges to the specified SCHEMA.
|
|
||||||
|
|
||||||
* `create_with_grant` - (Optional) Should the specified ROLE have CREATE privileges to the specified SCHEMA and the ability to GRANT the CREATE privilege to other ROLEs.
|
|
||||||
|
|
||||||
* `usage` - (Optional) Should the specified ROLE have USAGE privileges to the specified SCHEMA.
|
|
||||||
|
|
||||||
* `usage_with_grant` - (Optional) Should the specified ROLE have USAGE privileges to the specified SCHEMA and the ability to GRANT the USAGE privilege to other ROLEs.
|
|
||||||
|
|
||||||
* `role` - (Required) The ROLE who is receiving the policy.
|
|
||||||
|
|
||||||
* `schema` - (Required) The SCHEMA that is the target of the policy.
|
|
||||||
|
|
||||||
## Import Example
|
|
||||||
|
|
||||||
`postgresql_schema_policy` supports importing resources. Supposing the
|
|
||||||
following Terraform:
|
|
||||||
|
|
||||||
```
|
|
||||||
resource "postgresql_schema" "public" {
|
|
||||||
name = "public"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "postgresql_schema_policy" "public" {
|
|
||||||
create = true
|
|
||||||
usage = true
|
|
||||||
schema = "${postgresql_schema.public.name}"
|
|
||||||
role = "${postgresql_role.my_app.name}"
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
It is possible to import a `postgresql_schema_policy` resource with the
|
|
||||||
following command:
|
|
||||||
|
|
||||||
```
|
|
||||||
$ terraform import postgresql_schema_policy.public public
|
|
||||||
```
|
|
||||||
|
|
||||||
Where `public` is the name of the schema in the PostgreSQL database and
|
|
||||||
`postgresql_schema_policy.public` is the name of the resource whose state will
|
|
||||||
be populated as a result of the command.
|
|
|
@ -25,9 +25,6 @@
|
||||||
<li<%= sidebar_current("docs-postgresql-resource-postgresql_schema") %>>
|
<li<%= sidebar_current("docs-postgresql-resource-postgresql_schema") %>>
|
||||||
<a href="/docs/providers/postgresql/r/postgresql_schema.html">postgresql_schema</a>
|
<a href="/docs/providers/postgresql/r/postgresql_schema.html">postgresql_schema</a>
|
||||||
</li>
|
</li>
|
||||||
<li<%= sidebar_current("docs-postgresql-resource-postgresql_schema_policy") %>>
|
|
||||||
<a href="/docs/providers/postgresql/r/postgresql_schema_policy.html">postgresql_schema_policy</a>
|
|
||||||
</li>
|
|
||||||
</ul>
|
</ul>
|
||||||
</li>
|
</li>
|
||||||
</ul>
|
</ul>
|
||||||
|
|
Loading…
Reference in New Issue