title: Create read-only postgres user with terraform
body: <p>I'm trying to find the correct combination of terraform modules to create a read-only user in a postgres RDS instance.</p>
  
  <p><a href="https://www.terraform.io/docs/providers/postgresql/" rel="nofollow noreferrer">https://www.terraform.io/docs/providers/postgresql/</a></p>
  
  <p>I have a database with two schemas - <code>public</code> and <code>www</code>.</p>
  
  <p>I've started with:</p>
  
  <pre><code>resource "postgresql_role" "readonly" {                                                                                                                                                      
    name = "readonly"                                                                                                                                                                          
  }                                                                                                                                                                                            
  
  resource postgresql_grant "readonly_public" {                                                                                                                                                
    database    = "db_name"                                                                                                                                                                    
    role        = postgresql_role.readonly.name                                                                                                                                                
    schema      = "public"                                                                                                                                                                     
    object_type = "table"                                                                                                                                                                      
    privileges  = ["SELECT"]                                                                                                                                                                   
  }                                                                                                                                                                                            
  
  resource postgresql_grant "readonly_www" {                                                                                                                                                   
    database    = "db_name"                                                                                                                                                                    
    role        = postgresql_role.readonly.name                                                                                                                                                
    schema      = "www"                                                                                                                                                                        
    object_type = "table"                                                                                                                                                                      
    privileges  = ["SELECT"]                                                                                                                                                                   
  }                                                                                                                                                                                            
  
  resource "postgresql_role" "readonly_user" {                                                                                                                                                 
    name     = "readonly_user"                                                                                                                                                                 
    password = "some_password_123"                                                                                                                                                             
    login    = true                                                                                                                                                                            
    roles = [postgresql_role.readonly.name]                                                                                                                                                    
  }
  </code></pre>
  
  <p>with the intent being:</p>
  
  <p>1) Create a role called <code>readonly</code> that will only have <code>SELECT</code> access to the two schemas in <code>db_name</code> database.</p>
  
  <p>2) Create a user that can login called <code>readonly_user</code>, and give them the role <code>readonly</code>.</p>
  
  <p>When I do this, the created user can still (for example) create a table. However, they <em>do</em> have read-only access to the tables themselves.</p>
  
  <p>Lightly edited result of <code>\du</code>:</p>
  
  <pre><code>db_name=&gt; \du
  
       Role name  |   Attributes                   |  Member of
  ----------------+--------------------------------+---------------------------
   readonly_user  | Password valid until infinity  | {readonly}
   readonly       | Cannot login                  +| {}
                  | Password valid until infinity  | 
  </code></pre>
  
  <p>If there is a way to create a user that can <em>only</em> read information via terraform, I'd be greatly appreciative.</p>