On 2023-09-20 17:53 -0400, Michael Corey wrote:
> To make matters even more strange. I checked the permissions of
> rds_superuser in 15 and 14
>
> For 14
> GRANT pg_monitor, pg_signal_backend, rds_password, rds_replication TO
> rds_superuser WITH ADMIN OPTION;
>
> For 15
> GRANT pg_checkpoint, pg_monitor, *pg_read_all_data*, pg_signal_backend,
> *pg_write_all_data*, rds_password, rds_replication TO rds_superuser WITH
> ADMIN OPTION;
>
> AWS added these permissions, but based on what they do you would think this
> would allow the SELECTs in 15.
Yes it would if sten_schema would inherit from rds_superuser. But it
cannot inherit privileges from rds_superuser (indrect membership through
object_creator) because object_creator was created with NOINHERIT. And
INHERIT applies to direct memberships only.
--
Erik
