{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "item": { "id": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "slug": "apply-postgresql-default-grants-to-the-role-that-actually-creates-objects", "url": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects.md", "json": "https://update.dsesecurity.com/api/v1/posts/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/" }, "title": "Apply PostgreSQL default grants to the role that actually creates objects", "summary": "Test default grants through the real PostgreSQL migration identity before approving deployment access.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-15T13:32:41+00:00", "modified_at": "2026-10-15T13:36:15+00:00", "reviewed_on": "2026-10-15", "reading_minutes": 2, "word_count": 251, "potentially_affected": "This applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.", "dse_recommendation": "DSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants.", "primary_source": { "name": "PostgreSQL 17 — ALTER DEFAULT PRIVILEGES", "url": "https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html", "published_on": null, "authority": "www.postgresql.org" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Test default grants through the real PostgreSQL migration identity before approving deployment access.

\n

Source facts

\n

PostgreSQL 17 ALTER DEFAULT PRIVILEGES changes permissions for future objects, not objects that already exist. At creation time, the defaults of the current role apply; defaults are not inherited simply because that role belongs to another role. Defaults can be global within a database or scoped to specified schemas. Consequently, changing a convenient administrator’s defaults may not change the permissions on tables subsequently created by a different application migration role.

\n

Source: PostgreSQL 17 — ALTER DEFAULT PRIVILEGES.

\n

Applicability

\n

This applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.

\n

DSE recommendation

\n

DSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants. Keep a separate inventory of current objects that need a reviewed permission change. Have the application owner define the minimum intended access and distinguish tables, sequences, and other object types where relevant. Test the real deployment identity rather than an administrator’s interactive session. Store the approved grant policy with deployment documentation so later tooling changes do not silently change ownership assumptions.

\n

Verification

\n

In a test schema, create representative objects using the actual migration role and inspect their resulting privileges. Compare an object created before the change with one created afterward. Confirm required application actions succeed and unintended access fails without granting broader rights just to make the test pass.

\n

Official reference

\n

PostgreSQL 17 — ALTER DEFAULT PRIVILEGES. Reviewed October 15, 2026.

", "content_text": "Test default grants through the real PostgreSQL migration identity before approving deployment access.\nSource facts\nPostgreSQL 17 ALTER DEFAULT PRIVILEGES changes permissions for future objects, not objects that already exist. At creation time, the defaults of the current role apply; defaults are not inherited simply because that role belongs to another role. Defaults can be global within a database or scoped to specified schemas. Consequently, changing a convenient administrator’s defaults may not change the permissions on tables subsequently created by a different application migration role.\nSource: PostgreSQL 17 — ALTER DEFAULT PRIVILEGES.\nApplicability\nThis applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.\nDSE recommendation\nDSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants. Keep a separate inventory of current objects that need a reviewed permission change. Have the application owner define the minimum intended access and distinguish tables, sequences, and other object types where relevant. Test the real deployment identity rather than an administrator’s interactive session. Store the approved grant policy with deployment documentation so later tooling changes do not silently change ownership assumptions.\nVerification\nIn a test schema, create representative objects using the actual migration role and inspect their resulting privileges. Compare an object created before the change with one created afterward. Confirm required application actions succeed and unintended access fails without granting broader rights just to make the test pass.\nOfficial reference\nPostgreSQL 17 — ALTER DEFAULT PRIVILEGES. Reviewed October 15, 2026.", "content_markdown": "Test default grants through the real PostgreSQL migration identity before approving deployment access.\n\n## Source facts\n\nPostgreSQL 17 ALTER DEFAULT PRIVILEGES changes permissions for future objects, not objects that already exist. At creation time, the defaults of the current role apply; defaults are not inherited simply because that role belongs to another role. Defaults can be global within a database or scoped to specified schemas. Consequently, changing a convenient administrator’s defaults may not change the permissions on tables subsequently created by a different application migration role.\n\nSource: [PostgreSQL 17 — ALTER DEFAULT PRIVILEGES](https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html).\n\n## Applicability\n\nThis applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.\n\n## DSE recommendation\n\nDSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants. Keep a separate inventory of current objects that need a reviewed permission change. Have the application owner define the minimum intended access and distinguish tables, sequences, and other object types where relevant. Test the real deployment identity rather than an administrator’s interactive session. Store the approved grant policy with deployment documentation so later tooling changes do not silently change ownership assumptions.\n\n## Verification\n\nIn a test schema, create representative objects using the actual migration role and inspect their resulting privileges. Compare an object created before the change with one created afterward. Confirm required application actions succeed and unintended access fails without granting broader rights just to make the test pass.\n\n## Official reference\n\n[PostgreSQL 17 — ALTER DEFAULT PRIVILEGES](https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "url": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Apply PostgreSQL default grants to the role that actually creates objects", "item": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/#article", "identifier": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "url": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/", "headline": "Apply PostgreSQL default grants to the role that actually creates objects", "description": "Test default grants through the real PostgreSQL migration identity before approving deployment access.", "abstract": "Test default grants through the real PostgreSQL migration identity before approving deployment access.", "articleBody": "Test default grants through the real PostgreSQL migration identity before approving deployment access.\nSource facts\nPostgreSQL 17 ALTER DEFAULT PRIVILEGES changes permissions for future objects, not objects that already exist. At creation time, the defaults of the current role apply; defaults are not inherited simply because that role belongs to another role. Defaults can be global within a database or scoped to specified schemas. Consequently, changing a convenient administrator’s defaults may not change the permissions on tables subsequently created by a different application migration role.\nSource: PostgreSQL 17 — ALTER DEFAULT PRIVILEGES.\nApplicability\nThis applies to PostgreSQL 17 schema deployment and privilege administration. It addresses future-object grant behavior and does not replace reviewing existing object permissions or application access requirements.\nDSE recommendation\nDSE recommends identifying the effective object-creating role used by each migration path before adjusting default grants. Keep a separate inventory of current objects that need a reviewed permission change. Have the application owner define the minimum intended access and distinguish tables, sequences, and other object types where relevant. Test the real deployment identity rather than an administrator’s interactive session. Store the approved grant policy with deployment documentation so later tooling changes do not silently change ownership assumptions.\nVerification\nIn a test schema, create representative objects using the actual migration role and inspect their resulting privileges. Compare an object created before the change with one created afterward. Confirm required application actions succeed and unintended access fails without granting broader rights just to make the test pass.\nOfficial reference\nPostgreSQL 17 — ALTER DEFAULT PRIVILEGES. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:32:41+00:00", "dateModified": "2026-10-15T13:36:15+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/apply-postgresql-default-grants-to-the-role-that-actually-creates-objects/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Apply PostgreSQL default grants to the role that actually creates objects" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 251, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "PostgreSQL 17 — ALTER DEFAULT PRIVILEGES", "url": "https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html" } } ] } }