Improve fdc permissions setup #8339
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…, revoke users, and have sufficient permissions before diffing
joehan
approved these changes
Mar 19, 2025
| logger.info(clc.green("Database setup complete.")); | ||
| logger.info( | ||
| clc.yellow( | ||
| "IMPORTANT: please uncomment 'schemaValidation: \"COMPATIBLE\"' in your dataconnect.yaml file to avoid dropping any existing tables by mistake.", |
There was a problem hiding this comment.
(can be in a follow up) Should we just uncomment it by default in this case? Seems like a foot gun otherwise
There was a problem hiding this comment.
Are you aware of an easy way to do the uncommenting?
|
Could you also add some Scenarios Tested in the PR description? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR improves the FDC schema setup:
1- Make sure IAM user is upserted before sql:diff
2- Refactor brownfield setups to revoke owners after setup to avoid getting left with IAM roles.
3- Use transactions for schema setup commands to avoid problems when setup fails in intermediate state (e.g if we assign IAM role to firebasesuperuser then firebasesuperuser becomes IAM role and it becomes not possible to login using that role).
4- If schema is setup as brownfield then schema migration will fail without prompting the user to setup. If users decide to change their setup then they should run the setup command explicitly (this change doesn't affect fresh database, they are still automatically setup).
5- Improve messaging (tell users to turn on compate mode)
Scenarios tested: