postgres: Adding docs for creating a read only user. #2168

richard-joerger-aiven · 2023-10-03T19:11:25Z

What changed, and why it matters

Added a page on how to create read only users' on our platform. Helpful for deflecting support requests. Reached out to the SME's about some possible approaches for creating read only users on our platform. Useful in cases where a customer wants to limit a users' ability to access data.

Reached out to the SME's about some possible approaches for creating read only users on our platform. Useful in cases where a customer wants to limit a users' ability to access data.

cloudflare-workers-and-pages · 2023-10-03T19:18:26Z

Deploying with Cloudflare Pages

Latest commit:	`4be7747`
Status:	✅ Deploy successful!
Preview URL:	https://35fac1c7.devportal.pages.dev
Branch Preview URL:	https://rjoerger-pg-readonly-user.devportal.pages.dev

View logs

wojcik-dorota

Many thanks for adding these instructions :-)

wojcik-dorota · 2023-10-06T09:27:51Z

docs/products/postgresql/howto/readonly-user.rst

@@ -0,0 +1,15 @@
+Read Only User for PostgreSQL


Restrict access to databases or tables in Aiven for PostgreSQL®

wojcik-dorota · 2023-10-06T09:32:36Z

docs/products/postgresql/howto/readonly-user.rst

+=============================
+In the interest of having users with the least permissions to complete their tasks, one may need a user with read only access to the whole database or a handful of tables. In some cases, we may want this to happen automatically, below are two approaches to complete this task.
+
+All new objects shall have a role with read-only permissions


Set read-only access in a schema -------------------------------- You can set up the read-only access for a specific user's role in a particular schema.

wojcik-dorota · 2023-10-06T09:33:24Z

docs/products/postgresql/howto/readonly-user.rst

+
+2.  To update any existing database objects, run the following: ``GRANT SELECT ON ALL TABLES IN SCHEMA <schema name> to <myreadonlyrole>;``
+
+Only certain databases should be read-only for users in a particular role:


Set read-only access in a database ---------------------------------- You can set up the read-only access for a specific user's role in a particular database.

wojcik-dorota · 2023-10-06T12:33:49Z

docs/products/postgresql/howto.rst

@@ -40,6 +40,7 @@ Aiven for PostgreSQL® how-tos
    - :doc:`Prevent PostgreSQL® full disk issues </docs/products/postgresql/howto/prevent-full-disk>`
    - :doc:`Enable and use pgvector on Aiven for PostgreSQL® </docs/products/postgresql/howto/use-pgvector>`
    - :doc:`Check size of a database, a table or an index </docs/products/postgresql/howto/pg-object-size>`
+    - :doc:`Add Read Only User </docs/products/postgresql/howto/readonly-user>`


Plz change the title to "Restrict access to databases or tables in Aiven for PostgreSQL®".

Also, there's another listing file to be updated: Please add the new document to the /docs/products/postgresql/howto/list-dba-tasks.rst file.

wojcik-dorota · 2023-10-06T12:48:30Z

docs/products/postgresql/howto/readonly-user.rst

@@ -0,0 +1,15 @@
+Read Only User for PostgreSQL
+=============================
+In the interest of having users with the least permissions to complete their tasks, one may need a user with read only access to the whole database or a handful of tables. In some cases, we may want this to happen automatically, below are two approaches to complete this task.


Please rephrase into the following:

This article shows how you can restrict access to Aiven for PostgreSQL® databases and tables by setting up read-only permissions for specific user's roles.

wojcik-dorota · 2023-10-06T13:08:20Z

docs/products/postgresql/howto/readonly-user.rst

+
+Only certain databases should be read-only for users in a particular role:
+==========================================================================
+1. Create a new database which will be used as a template ``CREATE DATABASE ro_<name>_template...``


Please rephrase the steps as follows:

1. Create a template database by running the following query: .. code-block:: bash CREATE DATABASE ro_TEMPLATE_DATABASE_NAME_template 2. Update the standardizable information of the template database. (***how?) 3. Create a new database that uses the template database. .. code-block:: bash CREATE DATABASE DATABASE_NAME WITH TEMPLATE = 'ro_TEMPLATE_DATABASE_NAME_template'

*** Please also add how the user updates the standardizable information of the template database if possible.

The standard information in this case would be the specific permissions that the CU would like to have be part of their template. Shall I say apply standard permissions & roles instead?

Thanks, that makes sense! how about
2. For the new template database, set permissions and roles that you want as default ones in the template.

wojcik-dorota · 2023-10-06T13:25:05Z

docs/products/postgresql/howto/readonly-user.rst

+
+All new objects shall have a role with read-only permissions
+------------------------------------------------------------
+1. Alter the default permissions for the role for the given schema: ``ALTER DEFAULT PRIVILEGES FOR ROLE <target role> IN SCHEMA <schema name> abbreviated_grant_or_revoke``


Please rephrase the steps as follows:

1. Modify default permissions for a user's role in a particular schema. .. code-block:: bash ALTER DEFAULT PRIVILEGES FOR ROLE NAME_OF_ROLE IN SCHEMA NAME_OF_SCHEMA YOUR_GRANT_OR_REVOKE_PERMISSIONS 2. Apply the new read-only access setting to your existing database objects that uses the affected schema. .. code-block:: bash GRANT SELECT ON ALL TABLES IN SCHEMA NAME_OF_SCHEMA to NAME_OF_READ_ONLY_ROLE

What do you mean by abbreviated_grant_or_revoke? Is this a "hard" part of the code or a placeholder for including relevant value?

RE: abbreviated_grant_or_revoke, yes that is something the user would have to replace with their desired permissions. Shall I replace it with <grant or revoke>?

Let's use
YOUR_GRANT_OR_REVOKE_PERMISSIONS

Also, usually we use all-caps (a word with all the letters in the upper case) for variables or placeholders (as YOUR_GRANT_OR_REVOKE_PERMISSIONS). I see you use it for whole queries. Is that possible for you to update the queries by replacing all-caps words/expressions with the lower case unless otherwise required by the SQL standard?

Per the comments on the PR, I am fixing these docs to be more presentable.

wojcik-dorota · 2023-11-14T13:42:26Z

docs/products/postgresql/howto/list-dba-tasks.rst

@@ -39,7 +39,7 @@ Database administration tasks
        :shadow: md
        :margin: 2 2 0 0

-    .. grid-item-card:: :doc:`Use the PostgreSQL® pg_repack extension </docs/products/postgresql/howto/use-pg-repack-extension>`
+    .. grid-item-card:: :doc:`Use the PostgreSQL® pg_repack extension </docs/productspostgresql/howto/use-pg-repack-extension>`


In </docs/productspostgresql/howto/use-pg-repack-extension>, the slash is missing after products.

Queries don't have to be strictly uppercase. In order to be consistent with doc team standards, making the variables capitalized.

wojcik-dorota

Thank you :-)

postgres: Adding docs for creating a read only user.

6fdc98d

Reached out to the SME's about some possible approaches for creating read only users on our platform. Useful in cases where a customer wants to limit a users' ability to access data.

richard-joerger-aiven requested review from carabaestlein and wojcik-dorota October 3, 2023 19:12

wojcik-dorota self-assigned this Oct 5, 2023

wojcik-dorota added the PostgreSQL PG-related label Oct 6, 2023

wojcik-dorota suggested changes Oct 6, 2023

View reviewed changes

wojcik-dorota removed the request for review from carabaestlein October 29, 2023 17:12

wojcik-dorota assigned richard-joerger-aiven Nov 3, 2023

postgresql: Cleaning up Read Only User docs

f2962d3

Per the comments on the PR, I am fixing these docs to be more presentable.

wojcik-dorota suggested changes Nov 14, 2023

View reviewed changes

richard-joerger-aiven and others added 3 commits December 26, 2023 13:46

postgresql: Corrected language and link formatting.

ee37f6b

postgresql: Correcting casing in queries

77fada8

Queries don't have to be strictly uppercase. In order to be consistent with doc team standards, making the variables capitalized.

Update readonly-user.rst

4be7747

wojcik-dorota approved these changes Dec 27, 2023

View reviewed changes

wojcik-dorota merged commit 27bcfbd into main Dec 27, 2023
5 checks passed

wojcik-dorota deleted the rjoerger-pg-readonly-user branch December 27, 2023 07:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

postgres: Adding docs for creating a read only user. #2168

postgres: Adding docs for creating a read only user. #2168

richard-joerger-aiven commented Oct 3, 2023

cloudflare-workers-and-pages bot commented Oct 3, 2023 •

edited

Loading

wojcik-dorota left a comment •

edited

Loading

wojcik-dorota Oct 6, 2023

wojcik-dorota Oct 6, 2023

wojcik-dorota Oct 6, 2023

wojcik-dorota Oct 6, 2023

wojcik-dorota Oct 6, 2023

wojcik-dorota Oct 6, 2023

wojcik-dorota Oct 6, 2023

richard-joerger-aiven Nov 8, 2023

wojcik-dorota Nov 9, 2023

wojcik-dorota Oct 6, 2023 •

edited

Loading

richard-joerger-aiven Nov 8, 2023

wojcik-dorota Nov 9, 2023

wojcik-dorota Nov 9, 2023 •

edited

Loading

wojcik-dorota Nov 14, 2023

wojcik-dorota left a comment


		2. To update any existing database objects, run the following: ``GRANT SELECT ON ALL TABLES IN SCHEMA <schema name> to <myreadonlyrole>;``

		Only certain databases should be read-only for users in a particular role:

postgres: Adding docs for creating a read only user. #2168

postgres: Adding docs for creating a read only user. #2168

Conversation

richard-joerger-aiven commented Oct 3, 2023

What changed, and why it matters

cloudflare-workers-and-pages bot commented Oct 3, 2023 • edited Loading

Deploying with Cloudflare Pages

wojcik-dorota left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wojcik-dorota Oct 6, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wojcik-dorota Nov 9, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wojcik-dorota left a comment

Choose a reason for hiding this comment

cloudflare-workers-and-pages bot commented Oct 3, 2023 •

edited

Loading

wojcik-dorota left a comment •

edited

Loading

wojcik-dorota Oct 6, 2023 •

edited

Loading

wojcik-dorota Nov 9, 2023 •

edited

Loading