Security considerations v4

When running queries in the database, Lasso tries to use a role that has enough privileges to gather the required information from the tool from which metrics are being gathered.

The following are the tools and the roles that Lasso tries to use for each of them. Lasso tries to use the first available role in each tool role list. Initial connection role means the role that was provided through Lasso CLI when running the tool—usually postgres or enterprisedb.

• PostgreSQL:
  • pg_monitor
  • Initial connection role
• PgLogical:
  • pglogical_superuser
  • Initial connection role
• PGD:
  • bdr_monitor
  • Initial connection role
• PEM:
  • pem_user
  • Initial connection role
• Repmgr:
  • Initial connection role
• xDB:
  • Initial connection role

Most of the PGD gatherings try using the bdr_monitor role. However, the one in charge of gathering conflicts tries to use the role bdr_read_all_conflicts for that purpose. That's the only exception.

In any of the cases, it uses a read-only transaction while querying metrics and configurations from the database.