Allow setting roles for users

[jochem725]

what

• Add the roles parameter so database roles can be granted/assigned to users that are created by the postgres plugin.

why

• In this case this allows me to grant the rds_superuser role to a newly created user to manage extensions.

references

• https://registry.terraform.io/providers/cyrilgdn/postgresql/latest/docs/resources/postgresql_role.html#roles-1

Summary by CodeRabbit

• New Features
  • Assign PostgreSQL roles to created users via an optional roles list for additional users, granting membership at creation.
  • Role assignment is integrated into user creation while preserving existing grants and password handling.
  • Backward-compatible: omitting roles leaves prior behavior unchanged.

[coderabbitai]

Walkthrough

Adds a new optional roles field to the additional_users variable, threads each.value.roles through the root module into the postgresql-user module, and wires that value into the postgresql_role resource via a new roles attribute.

Changes

Cohort / File(s)	Summary of Changes
Root module wiring src/main.tf, src/variables.tf	Adds roles = each.value.roles to module "additional_users" call. Updates variable "additional_users" schema to include roles : optional(list(string), []).
PostgreSQL user module src/modules/postgresql-user/variables.tf, src/modules/postgresql-user/main.tf	Adds variable "roles" (type list(string), default null). Introduces local.db_roles = try(length(var.roles) > 0 ? var.roles : null, null) and sets roles = local.db_roles on postgresql_role "default".

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Terraform Root
  participant Var as additional_users (var)
  participant Mod as postgresql-user module
  participant Res as postgresql_role resource
  participant DB as PostgreSQL Server

  Dev->>Var: Iterate users (db_user, db_password, grants, roles)
  Dev->>Mod: Pass user inputs including roles
  Mod->>Mod: local.db_roles = var.roles or null
  Mod->>Res: Create role/user with roles = local.db_roles
  Res->>DB: Apply role creation and grants
  DB-->>Res: Result (success/error)
  Res-->>Dev: Provision outcome

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

needs-test

Suggested reviewers

• goruha

Poem

A rabbit hops through Terraform plains,
Passing roles along like little trains.
From vars to module, tidy and sweet,
Users gain roles — a coordinated feat.
Thump! Deploy now — the burrow's complete. 🐇✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title “Allow setting roles for users” clearly summarizes the primary change of the pull request, which is adding the ability to grant roles to database users; it is concise, specific, and directly reflects the feature introduced without extraneous detail.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between a573336 and c64a4eb.

📒 Files selected for processing (4)

• src/main.tf (1 hunks)
• src/modules/postgresql-user/main.tf (3 hunks)
• src/modules/postgresql-user/variables.tf (1 hunks)
• src/variables.tf (1 hunks)

🚧 Files skipped from review as they are similar to previous changes (2)

• src/modules/postgresql-user/main.tf
• src/main.tf

🧰 Additional context used

📓 Path-based instructions (2)

src/@(main|variables|outputs|providers|versions|context).tf

📄 CodeRabbit inference engine (AGENTS.md)

Keep all Terraform component code in src/ and structure it into main.tf, variables.tf, outputs.tf, providers.tf, versions.tf, and context.tf (src is the source of truth)

Files:

• src/variables.tf

src/**/*.tf

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.tf: Use 2-space indentation in Terraform files
In Terraform, use lower_snake_case for variables and locals
Keep Terraform resource and data source names descriptive and aligned with Cloud Posse null-label patterns
Run terraform fmt (recursive) and do not commit formatting violations
Follow TFLint rules as configured in .tflint.hcl; do not commit lint violations

Files:

• src/variables.tf
• src/modules/postgresql-user/variables.tf

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Summary

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1d5e690 and a573336.

📒 Files selected for processing (4)

• src/main.tf (1 hunks)
• src/modules/postgresql-user/main.tf (3 hunks)
• src/modules/postgresql-user/variables.tf (1 hunks)
• src/variables.tf (1 hunks)

🧰 Additional context used

📓 Path-based instructions (2)

src/**/*.tf

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.tf: Use 2-space indentation in Terraform files
In Terraform, use lower_snake_case for variables and locals
Keep Terraform resource and data source names descriptive and aligned with Cloud Posse null-label patterns
Run terraform fmt (recursive) and do not commit formatting violations
Follow TFLint rules as configured in .tflint.hcl; do not commit lint violations

Files:

• src/modules/postgresql-user/main.tf
• src/main.tf
• src/modules/postgresql-user/variables.tf
• src/variables.tf

src/@(main|variables|outputs|providers|versions|context).tf

📄 CodeRabbit inference engine (AGENTS.md)

Keep all Terraform component code in src/ and structure it into main.tf, variables.tf, outputs.tf, providers.tf, versions.tf, and context.tf (src is the source of truth)

Files:

• src/main.tf
• src/variables.tf

[goruha]

Suggested change

	default = null
	default = []

[goruha]

As this is the list pls set defaults to empty list

[goruha]

@jochem725 could you pls address the changes?

[goruha]

@jochem725 could you pls address the changes?