fix(ingestion): make the role grants runnable and drop the CREATE ROLE

[jirhiker]

ingestion_role.sql could not be run as written, and it instructed the operator
to do something that would have failed. Found while trying to execute it against
dataservices.

The CREATE ROLE was wrong

The script told you to uncomment a CREATE ROLE for the IAM principal. That
role already exists — registering a service account as a Cloud SQL IAM user
creates the Postgres role automatically, which Terraform does via
google_sql_user.ingestion:

$ gcloud sql users list --instance=dataservices
ocotillo-ingestion@waterdatainitiative-271000.iam   CLOUD_IAM_SERVICE_ACCOUNT

So the script now only grants, and says so. Reaching for a CREATE ROLE is a
signal the Terraform half has not been applied, not something to work around.

It could not run

role_name was hardcoded with \set while db_name was referenced and never
set, so every GRANT would have failed on an undefined variable.

Both are now required parameters, with a readable abort if either is missing:

psql "host=... dbname=ocotillo user=postgres" \
  -v db_name=ocotillo \
  -v role_name=ocotillo-ingestion@waterdatainitiative-271000.iam \
  -f automated_ingestion/sql/ingestion_role.sql

Requiring them is the point, not a formality. The instance hosts both
ocotillo and ocotillo-staging. Granting against the wrong one succeeds
silently and leaves you debugging the database you did not touch.

The role name contains @ and dots, so every reference uses :"role_name",
which quotes it as an identifier — unquoted is a syntax error.

Also

Stops tracking automated_ingestion/iac/.terraform.tfstate.lock.info, which was
committed with the us-west4 change. It is written while a run holds the state
lock and left behind when one is interrupted. A stale copy in a fresh checkout
is worse than useless: Terraform reports it as another user holding the lock.

Not verified against a live database

I could not run this — no psql here, the superuser is a built-in account whose
password I will not handle, and the account I am authenticated as has no
database login on the instance. The grants themselves are unchanged from the
reviewed version; what changed is that the script now runs and targets what you
tell it to.

🤖 Generated with Claude Code

[github-actions]

Coverage

✅ 79.27% total — gate is 75%.

[github-actions]

Your pull request is automatically being deployed to Dagster Cloud.

Location	Status	Link	Updated
ocotillo-automated-ingestion		View in Cloud	Aug 19, 2026 at 04:15 AM (UTC)