[ZdravkoDonev-redis]

Fix future-table read grants for PostgreSQL, including on-premises and Aurora. Update both current and 1.19.1 pages.

Example With Three Roles

• postgres: the administrator setting up RDI.
• app_migrations: the role that creates application tables.
• debezium: the user RDI uses to read tables.

The existing Aurora instructions run this as postgres:

ALTER DEFAULT PRIVILEGES IN SCHEMA public
    GRANT SELECT ON TABLES TO debezium;

This lets Debezium read future tables created by postgres. It does not cover tables created by app_migrations.

For example:

1. The administrator grants access to existing tables. The snapshot works.
2. A later migration creates new_orders as app_migrations.
3. Debezium does not receive SELECT permission from the administrator's defaults. Reading the new table can fail.

Run this as app_migrations, or as an administrator allowed to change its defaults:

ALTER DEFAULT PRIVILEGES FOR ROLE app_migrations IN SCHEMA public
    GRANT SELECT ON TABLES TO debezium;

Now future tables created by app_migrations in public grant Debezium read access. Existing tables still need their separate grants. These role names are examples; no new roles are required.

Changes

• Use <table_creator> to identify the role that runs CREATE TABLE.
• Keep the Aurora instructions short.
• Add existing-table and future-table grants to the regular PostgreSQL guide.
• Repeat the grants for each creator and schema.
• Keep read permissions separate from publication membership and pipeline selection.

The original scope followed the Aurora customer report. Default privileges are PostgreSQL behavior, so on-premises setups need the same guidance. The regular guide mentioned SELECT but lacked future-table instructions.

Validation

• git diff --check passed.
• Current and 1.19.1 grant sections match.
• PostgreSQL 16.15 / RDI 2.0.0 remote qualification passed: separate roles, future-table SELECT, fresh snapshot, and INSERT/UPDATE/DELETE delivery. See PR #2905 qualification.
• No new runtime test was run for this documentation update. Aurora-specific administrator permissions remain unqualified.

Ticket: RDSC-6239.
Publication safety: #4273. Networking: #4294.

---

Note

Low Risk
Documentation-only changes to RDI PostgreSQL grant instructions; no application or infrastructure code.

Overview
Clarifies how to grant Debezium read access to future PostgreSQL tables on the AWS Aurora/RDS PostgreSQL RDI prep pages (current and 1.19.1).

The grant privileges for the future step no longer tells admins to run ALTER DEFAULT PRIVILEGES only as postgres. It explains that default privileges apply per table-creating role (e.g. a migration role), adds a short three-role example, and updates the SQL to ALTER DEFAULT PRIVILEGES FOR ROLE <table_creator> IN SCHEMA <schema> …. Instructions now say to run that as the table creator (or an admin who can change that role’s defaults), repeat per creator/schema, and keep separate grants for existing tables.

Also fixes a stray "> typo in the schema usage grant placeholder text.

^{Reviewed by Cursor Bugbot for commit 8975ce9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Staging links:
https://redis.io/docs/staging/RDSC-6239-aurora-grants/integrate/redis-data-integration/1.19.1/data-pipelines/prepare-dbs/aws-aurora-rds/aws-aur-pgsql/
https://redis.io/docs/staging/RDSC-6239-aurora-grants/integrate/redis-data-integration/data-pipelines/prepare-dbs/aws-aurora-rds/aws-aur-pgsql/

[github-actions]

🧠 Redis Memory

Found 10 related items from repository history (2 new this commit):

• PR — DOC: clarify PostgreSQL publication setup for RDI

  Summary

• PR — Update AWS Aurora RDS setup instructions for PSQL

  Added SQL commands to grant privileges and create publication for Debezium user.

• Commit — DOC: update versioned RDI PostgreSQL guidance

  DOC: update versioned RDI PostgreSQL guidance

• Commit — DOC: clarify PostgreSQL publication setup for RDI

  DOC: clarify PostgreSQL publication setup for RDI

• PR — RDSC-6239: Correct database PrivateLink setup instructions

  The manual source setup uses HTTP/Anywhere IPv4 rules and calls the database address static. Replace these with a PrivateLink path using TCP

• Commit — RDSC-6239: Clarify Aurora future table grants

  RDSC-6239: Clarify Aurora future table grants

• Commit — RDSC-6239: Cover future table grants for all PostgreSQL setups

  RDSC-6239: Cover future table grants for all PostgreSQL setups

• PR — Document PostgreSQL 18 support for RDI

  What changed

• Commit — RDSC-6239: Explain future table grants with three roles in docs 🆕

  RDSC-6239: Explain future table grants with three roles in docs

• PR — Document Supabase support for RDI 🆕

  What changed

Memory updated at 8975ce9

[ZdravkoDonev-redis]

@andy-stark-redis Please review and directly merge if you're OK with the changes.

[mich-elle-luna]

thank you!