Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AlloyDB] Is it possible to grant IAM Service Accounts with read-write permissions without log in with postgres user? #461

Open
Nofugnosis opened this issue Aug 13, 2024 · 0 comments

Comments

@Nofugnosis
Copy link

Hi,

I'm trying to grant with select permission on a database in an AlloyDB instance to an IAM Service Account user. The idea is to grant with this permission without login using postgres user and do it while we provision the resources (alloydb cluster,primary instance, Service Accounts,etc)
I'm getting an error message and I think it's because this provider is not yet available for AlloyDB.

Code

terraform {
  required_providers {
    postgresql = {
      source = "cyrilgdn/postgresql"
      version = "1.22.0"
    }
  }  
}

provider "google" {
  credentials = file(var.gcp_credential_path)
  project     = var.project_id
  scopes = local.scopes
  region = "us-east1"
}


provider "postgresql" {
  host            = "primaryinstance-name"
  port            = 5432
  database        = "postgres"
  username        = "postgres"
  password        = "Pa$$w0rd"
  sslmode         = "require"
  connect_timeout = 15
  scheme          = "gcppostgres"
}

resource "postgresql_grant" "readonly_tables" {
  #depends_on = [ google_alloydb_instance.primary_instance ]
  database    = "postgres"
  role        = "[email protected]"
  schema      = "public"
  object_type = "table"
  privileges  = ["SELECT"]
}

Error message:

module.gcp_alloydb.google_alloydb_cluster.cluster[0]: Modifications complete after 25s [id=projects/sbx-200827-data/locations/us-east1/clusters/sbx-200827-data-dave-cluster]

Error: Error connecting to PostgreSQL server  (scheme: gcppostgres): ensure that the account has access to "instancename:5432" (and make sure there's no typo in that name). Error during generateEphemeral for instancename:5432: googleapi: Error 403: boss::NOT_AUTHORIZED: Not authorized to access resource. Possibly missing permission cloudsql.instances.connect on resource instances/sbx-226722-darch3-primary-instance1., forbidden

  with postgresql_grant.readonly_tables,
  on main.tf line 87, in resource "postgresql_grant" "readonly_tables":
  87: resource "postgresql_grant" "readonly_tables" {

If you see the error refer to a cloudsql.instances.connect permission error when I'm trying to access an AlloyDB instance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant