Postgres 角色和用户 - 表的权限被拒绝

Question

我按照https://aws.amazon.com/blogs/database/managing-postgresql-users-and-roles/中的说明配置了在RDS上运行的Postgres 11.2数据库

1. 我以创建 RDS 期间创建的主用户身份登录
2. 已执行CREATE SCHEMA myschema;
3. 从上面的链接执行的脚本

-- Revoke privileges from 'public' role
REVOKE CREATE ON SCHEMA public FROM PUBLIC;
REVOKE ALL ON DATABASE mydatabase FROM PUBLIC;

-- Read-only role
CREATE ROLE readonly;
GRANT CONNECT ON DATABASE mydatabase TO readonly;
GRANT USAGE ON SCHEMA myschema TO readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA myschema TO readonly;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT ON TABLES TO readonly;

-- Read/write role
CREATE ROLE readwrite;
GRANT CONNECT ON DATABASE mydatabase TO readwrite;
GRANT USAGE, CREATE ON SCHEMA myschema TO readwrite;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA myschema TO readwrite;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO readwrite;
GRANT USAGE ON ALL SEQUENCES IN SCHEMA myschema TO readwrite;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT USAGE ON SEQUENCES TO readwrite;

-- Users creation
CREATE USER reporting_user1 WITH PASSWORD 'some_secret_passwd';
CREATE USER reporting_user2 WITH PASSWORD 'some_secret_passwd';
CREATE USER app_user1 WITH PASSWORD 'some_secret_passwd';
CREATE USER app_user2 WITH PASSWORD 'some_secret_passwd';

-- Grant privileges to users
GRANT readonly TO reporting_user1;
GRANT readonly TO reporting_user2;
GRANT readwrite TO app_user1;
GRANT readwrite TO app_user2;

之后，我以app_user1 的身份连接并创建了一个新表并在其中添加了一行。然后，我使用reporting_user1 连接并尝试SELECT * FROM 那个新表，但在控制台上看到以下消息：

ERROR:  permission denied for table first_table
SQL state: 42501

我的配置中缺少什么？我希望reporting_user1 对myschema 中app_user1 创建的所有表具有读取权限。

Answer 1

来自documentation of ALTER DEFAULT PRIVILEGES：

您可以仅对将由您自己或您所属的角色创建的对象更改默认权限。可以全局设置权限（即，针对在当前数据库中创建的所有对象），或仅针对在指定模式中创建的对象。为每个模式指定的默认权限将添加到特定对象类型的全局默认权限中。

因此以master 运行ALTER DEFAULT PRIVILEGES 的效果不会影响app_user1 创建的表的默认权限。

要解决这个问题，您必须执行

ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT ON TABLES TO readonly;

也是app_user1。

Answer 2

我相信这是 Postgres 的行为，它只对现有实体应用授权，而不对未来的表应用权限。您必须通过为您的readonly 用户重新运行授权查询来更新新创建的表的权限。或者您可以设置一个触发器来自动执行此操作，就像这里提到的那样

Grant permissions to user for any new tables created in postgresql