问题:如何使用Terraform销毁RDS中其他用户拥有的Postgres数据库?

我设法很好地让 Terraform 在 RDS Postgres 数据库中创建数据库和角色,但由于rds_superuser的权限被剥离,我看不到一种简单的方法来销毁由另一个用户拥有的已创建数据库。

使用以下配置:

resource "postgresql_role" "app" {
  name                = "app"
  login               = true
  password            = "foo"
  skip_reassign_owned = true
}

resource "postgresql_database" "database" {
  name  = "app_database"
  owner = "${postgresql_role.app.name}"
}

(作为参考,skip_reassign_owned是必需的,因为rds_superuser组没有获得重新分配所有权所需的权限)

导致此错误:

Error applying plan:

1 error(s) occurred:

* postgresql_database.database (destroy): 1 error(s) occurred:

* postgresql_database.database: Error dropping database: pq: must be owner of database debug_db1

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

使用 local-exec 供应商,我能够将拥有数据库的角色授予管理员用户和应用程序用户:

resource "aws_db_instance" "database" {
  ...
}

provider "postgresql" {
  host            = "${aws_db_instance.database.address}"
  port            = 5432
  username        = "myadminuser"
  password        = "adminpassword"
  sslmode         = "require"
  connect_timeout = 15
}

resource "postgresql_role" "app" {
  name                = "app"
  login               = true
  password            = "apppassword"
  skip_reassign_owned = true
}

resource "postgresql_role" "group" {
  name                = "${postgresql_role.app.name}_group"
  skip_reassign_owned = true

  provisioner "local-exec" {
    command = "PGPASSWORD=adminpassword psql -h ${aws_db_instance.database.address} -U myadminuser postgres -c 'GRANT ${self.name} TO myadminuser, ${postgresql_role.app.name};'"
  }
}

resource "postgresql_database" "database" {
  name  = "mydatabase"
  owner = "${postgresql_role.group.name}"
}

与仅为应用程序用户设置所有权相比,这似乎有效。我确实想知道是否有更好的方法可以做到这一点而不必在本地执行人员中掏腰包?

解答

提出这个问题后,我设法提出了一个拉取请求,其中包含在 Postgresql 提供程序的版本 0.1.1 中发布的修复,因此现在可以在提供程序的最新版本中正常工作。