I want to create a read-only role in PostgreSQL and use it to assign it to multiple new users, who should have read-only access. It makes sense to me to also grant the read-only permissions to the role on the target DB. My concern is, whether the role, created with 'NOLOGIN' should have the 'CONNECT ON DATABASE' permission. Or is it better for some reason to grant the connect permission only to individual users with logins?
The role:
CREATE ROLE role_readonly WITH
NOLOGIN NOSUPERUSER INHERIT NOCREATEDB NOCREATEROLE NOREPLICATION VALID UNTIL 'infinity';
Permissions:
# should this be here?
GRANT CONNECT ON DATABASE db_name TO role_readonly;
#
GRANT USAGE ON SCHEMA public TO role_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO role_readonly;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO role_readonly;