github.com/danp/terraform@v0.9.5-0.20170426144147-39d740081351/website/source/docs/providers/postgresql/r/postgresql_role.html.markdown (about)

     1  ---
     2  layout: "postgresql"
     3  page_title: "PostgreSQL: postgresql_role"
     4  sidebar_current: "docs-postgresql-resource-postgresql_role"
     5  description: |-
     6    Creates and manages a role on a PostgreSQL server.
     7  ---
     8  
     9  # postgresql\_role
    10  
    11  The ``postgresql_role`` resource creates and manages a role on a PostgreSQL
    12  server.
    13  
    14  When a ``postgresql_role`` resource is removed, the PostgreSQL ROLE will
    15  automatically run a [`REASSIGN
    16  OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html)
    17  and [`DROP
    18  OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html) to
    19  the `CURRENT_USER` (normally the connected user for the provider).  If the
    20  specified PostgreSQL ROLE owns objects in multiple PostgreSQL databases in the
    21  same PostgreSQL Cluster, one PostgreSQL provider per database must be created
    22  and all but the final ``postgresql_role`` must specify a `skip_drop_role`.
    23  
    24  ~> **Note:** All arguments including role name and password will be stored in the raw state as plain-text.
    25  [Read more about sensitive data in state](/docs/state/sensitive-data.html).
    26  
    27  ## Usage
    28  
    29  ```hcl
    30  resource "postgresql_role" "my_role" {
    31    name     = "my_role"
    32    login    = true
    33    password = "mypass"
    34  }
    35  
    36  resource "postgresql_role" "my_replication_role" {
    37    name             = "replication_role"
    38    replication      = true
    39    login            = true
    40    connection_limit = 5
    41    password         = "md5c98cbfeb6a347a47eb8e96cfb4c4b890"
    42  }
    43  ```
    44  
    45  ## Argument Reference
    46  
    47  * `name` - (Required) The name of the role. Must be unique on the PostgreSQL
    48    server instance where it is configured.
    49  
    50  * `superuser` - (Optional) Defines whether the role is a "superuser", and
    51    therefore can override all access restrictions within the database.  Default
    52    value is `false`.
    53  
    54  * `create_database` - (Optional) Defines a role's ability to execute `CREATE
    55    DATABASE`.  Default value is `false`.
    56  
    57  * `create_role` - (Optional) Defines a role's ability to execute `CREATE ROLE`.
    58    A role with this privilege can also alter and drop other roles.  Default value
    59    is `false`.
    60  
    61  * `inherit` - (Optional) Defines whether a role "inherits" the privileges of
    62    roles it is a member of.  Default value is `true`.
    63  
    64  * `login` - (Optional) Defines whether role is allowed to log in.  Roles without
    65    this attribute are useful for managing database privileges, but are not users
    66    in the usual sense of the word.  Default value is `false`.
    67  
    68  * `replication` - (Optional) Defines whether a role is allowed to initiate
    69    streaming replication or put the system in and out of backup mode.  Default
    70    value is `false`
    71  
    72  * `bypass_row_level_security` - (Optional) Defines whether a role bypasses every
    73    row-level security (RLS) policy.  Default value is `false`.
    74  
    75  * `connection_limit` - (Optional) If this role can log in, this specifies how
    76    many concurrent connections the role can establish. `-1` (the default) means no
    77    limit.
    78  
    79  * `encrypted_password` - (Optional) Defines whether the password is stored
    80    encrypted in the system catalogs.  Default value is `true`.  NOTE: this value
    81    is always set (to the conservative and safe value), but may interfere with the
    82    behavior of
    83    [PostgreSQL's `password_encryption` setting](https://www.postgresql.org/docs/current/static/runtime-config-connection.html#GUC-PASSWORD-ENCRYPTION).
    84  
    85  * `password` - (Optional) Sets the role's password. (A password is only of use
    86    for roles having the `login` attribute set to true, but you can nonetheless
    87    define one for roles without it.) Roles without a password explicitly set are
    88    left alone.  If the password is set to the magic value `NULL`, the password
    89    will be always be cleared.
    90  
    91  * `valid_until` - (Optional) Defines the date and time after which the role's
    92    password is no longer valid.  Established connections past this `valid_time`
    93    will have to be manually terminated.  This value corresponds to a PostgreSQL
    94    datetime. If omitted or the magic value `NULL` is used, `valid_until` will be
    95    set to `infinity`.  Default is `NULL`, therefore `infinity`.
    96  
    97  * `skip_drop_role` - (Optional) When a PostgreSQL ROLE exists in multiple
    98    databases and the ROLE is dropped, the
    99    [cleanup of ownership of objects](https://www.postgresql.org/docs/current/static/role-removal.html)
   100    in each of the respective databases must occur before the ROLE can be dropped
   101    from the catalog.  Set this option to true when there are multiple databases
   102    in a PostgreSQL cluster using the same PostgreSQL ROLE for object ownership.
   103    This is the third and final step taken when removing a ROLE from a database.
   104  
   105  * `skip_reassign_owned` - (Optional) When a PostgreSQL ROLE exists in multiple
   106    databases and the ROLE is dropped, a
   107    [`REASSIGN OWNED`](https://www.postgresql.org/docs/current/static/sql-reassign-owned.html) in
   108    must be executed on each of the respective databases before the `DROP ROLE`
   109    can be executed to dropped the ROLE from the catalog.  This is the first and
   110    second steps taken when removing a ROLE from a database (the second step being
   111    an implicit
   112    [`DROP OWNED`](https://www.postgresql.org/docs/current/static/sql-drop-owned.html)).
   113  
   114  ## Import Example
   115  
   116  `postgresql_role` supports importing resources.  Supposing the following
   117  Terraform:
   118  
   119  ```hcl
   120  provider "postgresql" {
   121    alias = "admindb"
   122  }
   123  
   124  resource "postgresql_role" "replication_role" {
   125    provider = "postgresql.admindb"
   126  
   127    name = "replication_name"
   128  }
   129  ```
   130  
   131  It is possible to import a `postgresql_role` resource with the following
   132  command:
   133  
   134  ```
   135  $ terraform import postgresql_role.replication_role replication_name
   136  ```
   137  
   138  Where `replication_name` is the name of the role to import and
   139  `postgresql_role.replication_role` is the name of the resource whose state will
   140  be populated as a result of the command.