postgresql_default_privileges should allow empty list of privileges

[alec-rabold]

Hi, I was trying to revoke default privileges for functions/procedures from the PUBLIC role, which can be done by:

ALTER DEFAULT PRIVILEGES FOR ROLE <role> 
  REVOKE EXECUTE ON FUNCTIONS FROM public;

However it seems privileges currently requires at least one item in its list:

terraform-provider-postgresql/postgresql/resource_postgresql_default_privileges.go

Lines 60 to 67 in 26f257d

	"privileges": &schema.Schema{
	Type: schema.TypeSet,
	Required: true,
	Elem: &schema.Schema{Type: schema.TypeString},
	Set: schema.HashString,
	MinItems: 1,
	Description: "The list of privileges to apply as default privileges",
	},

I imagine this can be accomplished with something similar to what postgresql_grant does:

terraform-provider-postgresql/postgresql/resource_postgresql_grant.go

Lines 395 to 403 in 26f257d

	privileges := []string{}
	for _, priv := range d.Get("privileges").(*schema.Set).List() {
	privileges = append(privileges, priv.(string))
	}
	if len(privileges) == 0 {
	log.Printf("[DEBUG] no privileges to grant for role %s in database: %s,", d.Get("role").(string), d.Get("database"))
	return nil
	}

The use-case is tighter access control for functions/procedures and help prevent privilege escalation.

Terraform Version

0.13.7

Affected Resource(s)

• postgresql_default_privileges

Terraform Configuration Files

resource "postgresql_default_privileges" "revoke_functions_from_public" {
  role     = "public"
  database = postgresql_database.database.name

  owner       = "<role>"
  object_type = "function"
  privileges  = []
}

Expected Behavior

All privileges for the object_type are revoked, none are granted.

Actual Behavior

Error: privileges: attribute supports 1 item as a minimum, config has 0 declared

Steps to Reproduce

1. terraform apply

Important Factoids

In case it helps, running on AWS RDS, therefore template1 and the master user need to be used for the ALTER DEFAULT PRIVILEGES command to be successful.

References

Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:

• postgresql_grant resource should allow empty list of privileges #16

[alec-rabold]

Gave it a shot in #118, seems to work after building the provider locally and testing with that. Haven't had a chance to run the full test suite locally yet though.