Create DB privilege is not inherited

From: Ben Hancock <lists(at)benghancock(dot)com>
To: List-Postgres-General <pgsql-general(at)lists(dot)postgresql(dot)org>
Subject: Create DB privilege is not inherited
Date: 2023-07-27 12:47:37
Message-ID: 20230727054737.1f192102@shasta
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

Hi folks,

I've created a role 'admins' and conferred the CREATEDB and CREATE ROLE
privileges to this role. I'd like to be able to add users to this role
in order to easily manage group permissions. This doesn't seem to be
working the way I understand it should, though:

postgres=# CREATE ROLE admins WITH CREATEROLE CREATEDB;
CREATE ROLE
postgres=# CREATE USER joe;
CREATE ROLE
postgres=# GRANT admins TO joe;
GRANT ROLE
postgres=# SET ROLE joe;
SET
postgres=> CREATE DATABASE joes_db;
ERROR: permission denied to create database
postgres=> \dg
List of roles
Role name | Attributes | Member of
------------------+------------------------------------------------------------+-----------------
admins | Create role, Create DB, Cannot login | {}
joe | | {admins}
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}

postgres=>

Should the CREATEDB privilege be inherited when granting the 'admins'
role to a user, or is another step required?

Or (quite possibly) have I misunderstood something else?

Many thanks,

Ben Hancock
PostgreSQL 14.3

Responses

Browse pgsql-general by date

  From Date Subject
Next Message David G. Johnston 2023-07-27 13:09:28 Re: Create DB privilege is not inherited
Previous Message kg.postgresql 2023-07-27 10:27:06 Re: Bogus temp file reporting?