How can I create readonly user for backups in PostgreSQL?

Question

Is it true that it is IMPOSSIBLE to create a readonly backup user in PostgreSQL?

I've been advised on an IRC channel that you simply can't have a backup only user with no ownership privileges. I find it very strange so I want to make sure I'm not missing something.

Below is what I tried but it doesn't give me the results I'm looking for. When I do pg_dump on a given table I'm getting Permission denied for relation...:

GRANT SELECT ON ALL TABLES IN SCHEMA public TO backup; 
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO backup; 
GRANT SELECT, USAGE ON ALL SEQUENCES IN SCHEMA public TO backup;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE ON SEQUENCES TO backup;

Any help would be greatly appreciated!

Answer 1

No, it's easy (now anyway).

1. Grant the connect permission on a new user

   GRANT CONNECT ON DATABASE mydb TO myReadolyUser;
   

2. Grant the permissions on all the current database objects. This is schema-specific, and you'll have to run one copy for every schema you wish for your user to use,

   GRANT SELECT ON ALL TABLES IN SCHEMA mySchema TO myReadonlyUser;
   

   From the docs, ALL TABLES includes everything you'd want.

   There is also an option to grant privileges on all objects of the same type within one or more schemas. This functionality is currently supported only for tables, sequences, and functions (but note that ALL TABLES is considered to include views and foreign tables.

3. Then ALTER DEFAULT PRIVLEGES to grant future SELECT privileges for objects not yet created.

   ALTER DEFAULT PRIVILEGES IN SCHEMA mySchema
   GRANT SELECT ON TABLES TO myReadonlyUser;
   

Answer 2

The simple and nice way is to create a superuser with read only permission.

• Login psql as postgres or other superuser.

• Create the new superuser role and set it to read only :

  CREATE USER backadm SUPERUSER  password '<PASS>';
  ALTER USER backadm set default_transaction_read_only = on;
  

  • Replace <PASS> by your choosen password.
  • You can replace backadm by the choosen username. (I put backadm for Backup Administrator).
  • Do NOT forgot the single quotes for the password.

You can now use this role to backup.

Answer 3

After testing back up with Evan Caroll's solution I came across this error:

ERROR: permission denied for relation 'table'

there's one other permission missing:

GRANT SELECT ON ALL SEQUENCES IN SCHEMA mySchema TO myReadonlyUser

Adding this permission enabled me to do back up with my read-only user.

Answer 4

Note the blog referenced in the answer given by @Gyre will not work for creating an "application" read-only user (i.e, for creating a read only role for a web application to connect to the database), and might open up a serious security vulnerability, since its easily circumventable, as explained in this postgresql list response. For reference, by the client overriding the session settings:

SET SESSION CHARACTERISTICS AS TRANSACTION READ WRITE

Refer 'Managing rights in postgresql' presentation linked in the postgres wiki for a more detailed method, similar to the one posted in the question.

Answer 5

If you want (or can live with) a backup user having read-only access to all databases, you may use the pg_read_all_data role since the release of Postgres 14.

You can create such new user with permissions to read everything by running:

CREATE ROLE backup WITH ROLE pg_read_all_data LOGIN PASSWORD '<password>';

Answer 6

I have done some proper research and there DOES seem to be a solution for this. I've come across this blog post which perfectly explains what needs to be done. I hope this helps to people who are looking for the same answer as I was. Obviously - restoring the backups done this way is a different question.