postgresql - 如何使用 Terraform 销毁 RDS 中其他用户拥有的 Postgres 数据库？

Question

我设法很好地让 Terraform 在 RDS Postgres 数据库中创建数据库和角色，但由于 rds_superuser 的权限被剥离，我看不到一种简单的方法来销毁已创建的数据库归其他用户所有。

使用以下配置:

resource "postgresql_role" "app" {
  name                = "app"
  login               = true
  password            = "foo"
  skip_reassign_owned = true
}

resource "postgresql_database" "database" {
  name  = "app_database"
  owner = "${postgresql_role.app.name}"
}

(作为引用，skip_reassign_owned 是必需的，因为 rds_superuser 组没有获得重新分配所有权的必要权限)

导致这个错误:

Error applying plan:

1 error(s) occurred:

* postgresql_database.database (destroy): 1 error(s) occurred:

* postgresql_database.database: Error dropping database: pq: must be owner of database debug_db1

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

使用 local-exec provisioner，我能够将拥有数据库的角色授予管理员用户和应用程序用户:

resource "aws_db_instance" "database" {
  ...
}

provider "postgresql" {
  host            = "${aws_db_instance.database.address}"
  port            = 5432
  username        = "myadminuser"
  password        = "adminpassword"
  sslmode         = "require"
  connect_timeout = 15
}

resource "postgresql_role" "app" {
  name                = "app"
  login               = true
  password            = "apppassword"
  skip_reassign_owned = true
}

resource "postgresql_role" "group" {
  name                = "${postgresql_role.app.name}_group"
  skip_reassign_owned = true

  provisioner "local-exec" {
    command = "PGPASSWORD=adminpassword psql -h ${aws_db_instance.database.address} -U myadminuser postgres -c 'GRANT ${self.name} TO myadminuser, ${postgresql_role.app.name};'"
  }
}

resource "postgresql_database" "database" {
  name  = "mydatabase"
  owner = "${postgresql_role.group.name}"
}

与仅为应用程序用户设置所有权相比，这似乎更有效。我确实想知道是否有更好的方法可以做到这一点而不必花钱在本地执行程序中？

Answer 1

提出这个问题后，我设法提出了一个 pull request with the fix在 version 0.1.1 of the Postgresql provider 中发布所以现在在提供程序的最新版本中工作正常。