0

I am trying to set up row level security in an Amazon RDS database (Postgres 15) to power a Django project.

The user I pass to Django is not superuser and doesn't have BYPASSRLS inherited from any of it's roles. I know that from this query:

SELECT
    rolname,
    rolsuper,
    rolbypassrls
FROM
    pg_roles
WHERE
    oid in (
        WITH RECURSIVE cte AS (
            SELECT
                oid
            FROM
                pg_roles
            WHERE
                rolname = current_user
            UNION
            ALL
            SELECT
                m.roleid
            FROM
                cte
                JOIN pg_auth_members m ON m.member = cte.oid
        )
        SELECT
            oid
        FROM
            cte
    )

The user does own the database, schema and table, but when I added the policy I also ran:

ALTER TABLE certain_table ENABLE ROW LEVEL SECURITY;
ALTER TABLE certain_table FORCE ROW LEVEL SECURITY;

On a local Postgres (Docker) and the same setup, executing SELECT row_security_active('certain_table') return True. On RDS it returns False.

Am I missing any other criteria for bypassing row level security?

3
  • Is there anything rds_superuser has that makes them bypass RLS while having rolsuper=False and rolbypassrls=False? Commented Nov 14, 2023 at 11:23
  • What is the value of the parameter row_security? Also, consider the possibility that AMAZON hacked up this part of the code. Commented Nov 14, 2023 at 16:58
  • 1
    @LaurenzAlbe It's on. Apparently rds_superuser has something that makes them bypass RLS. We changed the user and it works now. Would be good to know what's provoking the bypass, though. Commented Nov 15, 2023 at 10:55

1 Answer 1

0

As provisional answer, there's something in rds_superuser that makes them bypass RLS. What exactly, that is still unknown to me. I changed the user and RLS is working properly now. A better answer would be to know exactly how the bypass is happening, so that it can be detected from a query to the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.