@cfxlabsinc/b2b-services
    Preparing search index...

    Interface AuroraWorkloadUserArgs

    interface AuroraWorkloadUserArgs {
        accountId?: Input<string>;
        bypassRls?: boolean;
        clusterResourceId: Input<string>;
        database: Input<string>;
        inRoles?: Input<Input<string>[]>;
        pgProvider: Provider;
        proxyRoleName: Input<string>;
        region?: Input<string>;
        searchPath?: Input<string>;
        workloadName: string;
    }
    Index
    accountId? bypassRls? clusterResourceId database inRoles? pgProvider proxyRoleName region? searchPath? workloadName
    accountId?: Input<string>

    Defaults to caller identity.

    bypassRls?: boolean

    Give this role BYPASSRLS. Defaults to true.

    Every table in the schema has RLS enabled (drizzle .enableRLS()) but the codebase defines zero policies — RLS-on + no-policy denies all access to any role that is neither the table owner nor a bypasser. On Supabase the app connected as a bypassing/owner role, so this was invisible; the Aurora workload roles are least-privilege and are NOT owners, so without BYPASSRLS every read returns nothing and every write fails with new row violates row-level security policy (SQLSTATE 42501).

    The app's real authorization boundary is application-level, not DB RLS, so bypass restores the intended (Supabase) behaviour. Set false only for a role that is genuinely meant to be constrained by policies — none exist today.

    clusterResourceId: Input<string>

    Aurora cluster resource ID (cluster-XXXXXXXX). Exported by cfx-db as auroraClusterResourceId. Used to scope the rds-db:connect policy on the shared proxy role — the proxy needs to authenticate upstream to Aurora as this workload's dbuser.

    database: Input<string>

    Target database name in the Aurora cluster. The role is cluster-global (Postgres roles always are), but this scopes the CONNECT grant and is exposed as an output so apps can build connection strings from the stack reference. Schema/table grants still go in dbmate migrations.

    inRoles?: Input<Input<string>[]>

    Additional group roles this workload inherits from. rds_iam is always included (required for IAM auth) — do not list it here. Typical production usage passes one of the per-domain *_read_write / *_read_only group roles provisioned by the per-DB stack to pick up schema grants.

    pgProvider: Provider

    Postgres admin provider that can CREATE ROLE and GRANT.

    proxyRoleName: Input<string>

    Name of the shared RDS Proxy IAM role (exported by cfx-db as auroraProxyRoleName). The component attaches an inline rds-db:connect policy scoped to this workload's cluster dbuser ARN onto the proxy role — required for the proxy to authenticate upstream to Aurora via IAM. Bounded by the proxy role's existing workload permissions boundary.

    region?: Input<string>

    Defaults to the current provider region.

    searchPath?: Input<string>

    search_path set on the role (ALTER ROLE ... SET search_path TO ...). Matches the Supabase pattern (e.g. b2b,extensions). Omit to leave default.

    workloadName: string

    Short workload identifier. Used verbatim as the Postgres role name; must be a valid role name. Must match /^[a-z][a-z0-9_]{0,30}$/.

    Settings
    Member Visibility

    On This Page
    Properties