3
VOTE
Status
Future consideration
Workspace
* IBM Cloud Ideas
Categories
Databases
Created by
Guest
Created on
Apr 24, 2024
RELATED IDEAS
Allow creating read-only Service Credentials for IBM Cloud Databases for Postgres
Currently we can only create read/write Service Credentials for IBM Cloud Databases for Postgres. However in some cases such as when a SRE or dev needs to investigate the database, they only require read-only access, so it would be nice to be able to have separate read-only credentials to be used by those users.
The documentation at https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-user-management&interface=ui says that read only users can only be created directly in Postgres, but this comes at the disadvantage of not being able to integrate those credentials with access control (IAM)
| Idea priority | High |
| Needed By | Yesterday (Let's go already!) |
By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.
The "ibm-cloud-base-user" role is currently automatically added to any user created through the ICD APIs for postgres and that API doesn't allow for specifying different roles. Our team also has the need to support a mix of app-functional users which should only have read/write for their specific databases and devops/developers users who should only have read-only access. This idea creator and my team would benefit from the ability to specify which roles a given user should be assigned to (just a few predefined roles would be fine) and then we can configure those database permissions against those roles with our default admin id that ICD gives us.
To manage this in an automated fashion, we're ideally looking for the role parameter at https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/database#role to support postgres (like it does for Redis). We are focused on managing this through terraform's ICD provider because that flow lets us cleanly manage blue-green-user password rotation via IBM Schematics.