权限被拒绝复制数据库

Question

I'm still getting used to the concept of roles in Postgres.

I'm trying to create a role, migrator , that will have the ability to read from a production db and use it as a template to make stage and dev databases.

I've created this role migrator originally like so:

CREATE ROLE migrator LOGIN ENCRYPTED PASSWORD '<password>'

and proceeded to restrict access to the prod database:

REVOKE ALL ON DATABASE prod FROM PUBLIC;
GRANT CONNECT ON DATABASE prod TO migrator;
/* switch to prod database */
GRANT USAGE ON SCHEMA public TO migrator;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO migrator;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO migrator;

After trying a CREATE DATABASE stage TEMPLATE prod; and getting an error, I had to alter the role to create a db:

ALTER ROLE migrator CREATEDB;

and tried again. This time I got the error: ERROR: permission denied to copy database "prod"

And again, I tried to add the replication permission to the migrator role (not sure if this is correct, as the manual says this is a very elevated permission)

ALTER ROLE migrator REPLICATION;

however, I still get the same error.

UPDATE: I've figured out that this has something to do with who owns the database; however, my problem remains. How can I allow another role with just READ privileges the ability to copy a database as well? I looked at role inheritance, but at first glance it looks like the inheriting role will just get the same permissions as the parent role.

Answer 1

It's not possible to copy a database unless the logged-in role is an owner or the database is flagged as a template :

datistemplate can be set to indicate that a database is intended as a template for CREATE DATABASE. If this flag is set, the database can be cloned by any user with CREATEDB privileges; if it is not set, only superusers and the owner of the database can clone it.