[ZdravkoDonev-redis]

Fix future-table read grants for PostgreSQL, including on-premises and Aurora. Update both current and 1.19.1 pages.

Example With Three Roles

• postgres: the administrator setting up RDI.
• app_migrations: the role that creates application tables.
• debezium: the user RDI uses to read tables.

The existing Aurora instructions run this as postgres:

ALTER DEFAULT PRIVILEGES IN SCHEMA public
    GRANT SELECT ON TABLES TO debezium;

This lets Debezium read future tables created by postgres. It does not cover tables created by app_migrations.

For example:

1. The administrator grants access to existing tables. The snapshot works.
2. A later migration creates new_orders as app_migrations.
3. Debezium does not receive SELECT permission from the administrator's defaults. Reading the new table can fail.

Run this as app_migrations, or as an administrator allowed to change its defaults:

ALTER DEFAULT PRIVILEGES FOR ROLE app_migrations IN SCHEMA public
    GRANT SELECT ON TABLES TO debezium;

Now future tables created by app_migrations in public grant Debezium read access. Existing tables still need their separate grants. These role names are examples; no new roles are required.

Changes

• Use <table_creator> to identify the role that runs CREATE TABLE.
• Keep the Aurora instructions short.
• Add existing-table and future-table grants to the regular PostgreSQL guide.
• Repeat the grants for each creator and schema.
• Keep read permissions separate from publication membership and pipeline selection.

The original scope followed the Aurora customer report. Default privileges are PostgreSQL behavior, so on-premises setups need the same guidance. The regular guide mentioned SELECT but lacked future-table instructions.

Validation

• git diff --check passed.
• Current and 1.19.1 grant sections match.
• PostgreSQL 16.15 / RDI 2.0.0 remote qualification passed: separate roles, future-table SELECT, fresh snapshot, and INSERT/UPDATE/DELETE delivery. See PR #2905 qualification.
• No new runtime test was run for this documentation update. Aurora-specific administrator permissions remain unqualified.

Ticket: RDSC-6239.
Publication safety: #4273. Networking: #4294.

---

Note

Low Risk
Documentation-only updates to RDI PostgreSQL permission guidance; no application or infrastructure code changes.

Overview
Clarifies how RDI/Debezium should get SELECT on PostgreSQL tables when migrations run under a role other than the admin (e.g. app_migrations), in both the general PostgreSQL and AWS Aurora/RDS prepare guides (current and 1.19.1).

The Aurora “future privileges” step now uses ALTER DEFAULT PRIVILEGES FOR ROLE <table_creator> instead of defaults scoped only to the postgres user, with a short three-role example and guidance to run the command as the table creator (or an admin who can change that role’s defaults), repeat per creator/schema, and keep separate grants for existing tables. A markdown typo in the schema-usage step is fixed.

The on-premises PostgreSQL guide gains a new “Grant access to existing and future tables” subsection with explicit GRANT USAGE / GRANT SELECT ON ALL TABLES for snapshots plus the same future-table default-privileges pattern, and notes that read grants do not add tables to publications or the RDI pipeline.

^{Reviewed by Cursor Bugbot for commit 7059139. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Staging links:
https://redis.io/docs/staging/RDSC-6239-aurora-grants/integrate/redis-data-integration/1.19.1/data-pipelines/prepare-dbs/aws-aurora-rds/aws-aur-pgsql/
https://redis.io/docs/staging/RDSC-6239-aurora-grants/integrate/redis-data-integration/1.19.1/data-pipelines/prepare-dbs/postgresql/
https://redis.io/docs/staging/RDSC-6239-aurora-grants/integrate/redis-data-integration/data-pipelines/prepare-dbs/aws-aurora-rds/aws-aur-pgsql/
https://redis.io/docs/staging/RDSC-6239-aurora-grants/integrate/redis-data-integration/data-pipelines/prepare-dbs/postgresql/

[github-actions]

🧠 Redis Memory

Found 8 related items from repository history (2 new this commit):

• PR — DOC: clarify PostgreSQL publication setup for RDI

  Summary

• PR — Update AWS Aurora RDS setup instructions for PSQL

  Added SQL commands to grant privileges and create publication for Debezium user.

• Commit — DOC: update versioned RDI PostgreSQL guidance

  DOC: update versioned RDI PostgreSQL guidance

• Commit — DOC: clarify PostgreSQL publication setup for RDI

  DOC: clarify PostgreSQL publication setup for RDI

• PR — RDSC-6239: Correct database PrivateLink setup instructions

  The manual source setup uses HTTP/Anywhere IPv4 rules and calls the database address static. Replace these with a PrivateLink path using TCP

• Commit — RDSC-6239: Clarify Aurora future table grants

  RDSC-6239: Clarify Aurora future table grants

• Commit — RDSC-6239: Cover future table grants for all PostgreSQL setups 🆕

  RDSC-6239: Cover future table grants for all PostgreSQL setups

• PR — Document PostgreSQL 18 support for RDI 🆕

  What changed

Memory updated at 7059139

[ZdravkoDonev-redis]

@andy-stark-redis Please review and directly merge if you're OK with the changes.