add support for "ADMIN" option in "CREATE ROLE"

[joaocc]

According to the documentation (https://registry.terraform.io/providers/cyrilgdn/postgresql/latest/docs/resources/postgresql_role), there doesn't seem to be a way to create a new ROLE and define an admin (or a set of admins) for that role.
In PostgresSQL this is achieved with the ADMIN option on CREATE ROLE https://www.postgresql.org/docs/current/sql-createrole.html

Are there any plans to support this in this provider? If not, what is the recommended approach to set these on creation?

The real-world scenario here is that on a shared server, the dba account can create tenant specific roles T_admin/T_read/T_write, with the idea to have T_admin be able to manage memberships of T_read and T_write

Thanks!

[cyrilgdn]

Hi @joaocc ,

It's not supported directly by the postgresql_role resource but you can use the postgresql_grant_role resource to define that, e.g. something like:

resource "postgresql_role" "t_read" {
  name = "T_read"
}

resource "postgresql_grant_role" "admin_t_read" {
  role       = postgreql_role.t_read.name
  grant_role = "T_admin"

  with_admin_option = true
}

Let me know if it solves your question?

[jmacnett]

I see this one has been open for quite awhile, but I ran into it today myself. Tried the proposed fix (using your example above), and came up with

postgresql_grant_role.admin_t_read: Creating...
╷
│ Error: could not execute revoke query: pq: permission denied to revoke role "t_admin"

I'm operating in Azure Flexible postgresql, so superuser is unfortunately out in terms of what I can run this under. Has this been dealt with another way?