Given a postgresql_role and a resource dependent on that role, an error is thrown when removing the dependency and destroying the role, as Terraform attempts to perform the destroy before the update. This only occurs if the database of the provider block is different than the database containing the resource.
What that terraform does:
a) creates a database
2) creates a role
d) makes the role owner of something (in this example, a publication). This creates a dependency between the something and the role
Steps to Reproduce
start a local postgresql instance listening on port 54321:
docker run -it --rm -e POSTGRES_HOST_AUTH_METHOD=trust -p 54321:5432 postgres:15-alpine
terraform init && terraform apply the above terraform
remove the role from the code and update the owner (this removes the dependency on the role):
# destroy the role by (say) commenting out the terraform
#resource "postgresql_role" "publication_owner" {
# name = "${postgresql_database.db.name}_publication_owner"
#}
# update the owner to no longer reference the role
resource "postgresql_publication" "pub" {
database = postgresql_database.db.name
name = "my_publication"
owner = "postgres" # HERE
}
terraform apply
Expected Behavior
owner should be updated and role destroyed
Actual Behavior
Error: could not delete role delete_before_update_publication_owner: pq: role "delete_before_update_publication_owner" cannot be dropped because some objects depend on it
Important Factoids
issue originally discovered on AWS RDS Aurora Postgresql 15, and reproduced locally
if the provider specifies the same database as the thing dependent on the role, the error does not occur. That is, the role is destroyed without issue and the publication owner updated.
Given a
postgresql_role
and a resource dependent on that role, an error is thrown when removing the dependency and destroying the role, as Terraform attempts to perform the destroy before the update. This only occurs if the database of theprovider
block is different than the database containing the resource.Terraform Version
Affected Resource(s)
Terraform Configuration Files
What that terraform does: a) creates a database 2) creates a role d) makes the role owner of something (in this example, a publication). This creates a dependency between the something and the role
Steps to Reproduce
terraform init && terraform apply
the above terraformremove the role from the code and update the owner (this removes the dependency on the role):
terraform apply
Expected Behavior
owner should be updated and role destroyed
Actual Behavior
Error: could not delete role delete_before_update_publication_owner: pq: role "delete_before_update_publication_owner" cannot be dropped because some objects depend on it
Important Factoids
provider
specifies the same database as the thing dependent on the role, the error does not occur. That is, the role is destroyed without issue and the publication owner updated.