Skip to content

fix: grant Vault privs to service_role #1539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Apr 24, 2025
Merged

fix: grant Vault privs to service_role #1539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c38bfab
fix: grant Vault privs to service_role
soedirgo Apr 11, 2025
62afdda
adjust tests according to the fix
steve-chavez Apr 14, 2025
df38858
chore: bump versions
steve-chavez Apr 14, 2025
a74b26a
fix: missing Vault privileges for postgres
soedirgo Apr 16, 2025
fadfbe7
fix: also privs in the migration
soedirgo Apr 23, 2025
a911b07
test: schema snapshots changed
soedirgo Apr 23, 2025
832e2cb
Merge branch 'develop' into fix/grant-vault-privs-to-service_role
soedirgo Apr 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
grant usage on schema vault to postgres with grant option;
grant select, delete on vault.secrets, vault.decrypted_secrets to postgres with grant option;
grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres with grant option;
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;

-- service_role used to be able to manage secrets in Vault <=0.2.8 because it had privileges to pgsodium functions
grant usage on schema vault to service_role;
grant select, delete on vault.secrets, vault.decrypted_secrets to service_role;
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role;
6 changes: 3 additions & 3 deletions ansible/vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ postgres_major:

# Full version strings for each major version
postgres_release:
postgresorioledb-17: "17.0.1.069-orioledb"
postgres17: "17.4.1.019"
postgres15: "15.8.1.076"
postgresorioledb-17: "17.0.1.070-orioledb"
postgres17: "17.4.1.020"
postgres15: "15.8.1.077"

# Non Postgres Extensions
pgbouncer_release: "1.19.0"
Expand Down
9 changes: 6 additions & 3 deletions migrations/db/migrations/20221207154255_create_pgsodium_and_vault.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,12 @@ BEGIN

-- for some reason extension custom scripts aren't run during AMI build, so
-- we manually run it here
GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
grant usage on schema vault to postgres with grant option;
grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres with grant option;
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;
grant usage on schema vault to service_role;
grant select, delete on vault.secrets, vault.decrypted_secrets to service_role;
grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role;
ELSE
pgsodium_exists = (
select count(*) = 1
Expand Down
3 changes: 2 additions & 1 deletion nix/tests/expected/roles.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -575,6 +575,7 @@ order by schema_order, schema_name, privilege_type, grantee, default_for;
topology | USAGE | supabase_admin | supabase_admin
vault | CREATE | supabase_admin | supabase_admin
vault | USAGE | postgres | supabase_admin
vault | USAGE | service_role | supabase_admin
vault | USAGE | supabase_admin | supabase_admin
(390 rows)
(391 rows)

13 changes: 12 additions & 1 deletion nix/tests/expected/vault.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,13 +28,19 @@ ORDER BY object_name, grantee, privilege_type;
schema | object_name | grantee | privilege_type
--------+---------------------------+----------------+----------------
vault | _crypto_aead_det_decrypt | postgres | EXECUTE
vault | _crypto_aead_det_decrypt | service_role | EXECUTE
vault | _crypto_aead_det_decrypt | supabase_admin | EXECUTE
vault | _crypto_aead_det_encrypt | supabase_admin | EXECUTE
vault | _crypto_aead_det_noncegen | supabase_admin | EXECUTE
vault | create_secret | postgres | EXECUTE
vault | create_secret | service_role | EXECUTE
vault | create_secret | supabase_admin | EXECUTE
vault | decrypted_secrets | postgres | DELETE
vault | decrypted_secrets | postgres | REFERENCES
vault | decrypted_secrets | postgres | SELECT
vault | decrypted_secrets | postgres | TRUNCATE
vault | decrypted_secrets | service_role | DELETE
vault | decrypted_secrets | service_role | SELECT
vault | decrypted_secrets | supabase_admin | DELETE
vault | decrypted_secrets | supabase_admin | INSERT
vault | decrypted_secrets | supabase_admin | REFERENCES
Expand All @@ -43,7 +49,11 @@ ORDER BY object_name, grantee, privilege_type;
vault | decrypted_secrets | supabase_admin | TRUNCATE
vault | decrypted_secrets | supabase_admin | UPDATE
vault | secrets | postgres | DELETE
vault | secrets | postgres | REFERENCES
vault | secrets | postgres | SELECT
vault | secrets | postgres | TRUNCATE
vault | secrets | service_role | DELETE
vault | secrets | service_role | SELECT
vault | secrets | supabase_admin | DELETE
vault | secrets | supabase_admin | INSERT
vault | secrets | supabase_admin | REFERENCES
Expand All @@ -52,8 +62,9 @@ ORDER BY object_name, grantee, privilege_type;
vault | secrets | supabase_admin | TRUNCATE
vault | secrets | supabase_admin | UPDATE
vault | update_secret | postgres | EXECUTE
vault | update_secret | service_role | EXECUTE
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Effects of the changes now can be clearly visualized.

vault | update_secret | supabase_admin | EXECUTE
(26 rows)
(37 rows)

-- vault indexes with owners
SELECT
Expand Down
Loading