db role

A role is a login on a managed instance. Creating one is how a service gets its own credential rather than sharing the first one.

Passwords are not returned by any of these commands. A role's password reaches you inside the connection string that db url builds, and nowhere else.

db role list

List the logins a database accepts.

Usage

outplane db role list <DATABASE>

Arguments

Output

Examples

Which logins exist

outplane db role list orders

Read the names in a pipeline

outplane db role list orders --json --fields name

{
  "items": [
    {
      "name": "app"
    }
  ],
  "total": 1,
  "truncated": false
}

Check whether one exists before creating it

outplane db role list orders -o text

What to Know

• A database that is still provisioning reports none, which is a state rather than an error.
• Passwords are not here and are not anywhere else either. db url assembles a connection string that contains one.

Errors

Beyond 0 for success, this command exits with:

The code on the error object is one of db.not_found, usage.missing_argument. Branch on that, or on the exit status. The message is prose and changes.

db role create

Add a login to a database.

Usage

outplane db role create <DATABASE> <ROLE>

Arguments

Output

Examples

Check the request without creating anything

outplane db role create orders checkout --dry-run --json

{
  "changed": false,
  "kind": "role",
  "name": "checkout"
}

A login for one application

outplane db role create orders checkout

Create one and read its connection string

outplane db role create orders checkout --json --fields name,changed

What to Know

• The password is generated and never returned by this command. It is in the connection string and nowhere else, so read it there when it is needed.
• Creating the same role twice is refused by the provider rather than being a no-op.

Errors

Beyond 0 for success, this command exits with:

The code on the error object is one of db.not_found, usage.missing_argument. Branch on that, or on the exit status. The message is prose and changes.

db role delete

Remove a login.

Usage

outplane db role delete <DATABASE> <ROLE> [flags]

Arguments

Flags

The global flags apply as well.

Output

Examples

See what would go

outplane db role delete orders old --dry-run

The confirmed form

outplane db role delete orders old --yes --confirm-name old

Read what the name resolves to, before confirming

outplane db role delete orders old --dry-run --json

{
  "changed": false,
  "kind": "role",
  "name": "old"
}

What to Know

• Never prompts. Without confirmation it exits 4 and returns the command to replay in the error's confirm_command field.
• Under a detected agent harness it exits 4 even with both flags.
• Nothing updates the applications holding a connection string. They fail on their next connection.

Errors

Beyond 0 for success, this command exits with:

The code on the error object is one of confirmation.required, db.confirm_name_mismatch, db.not_found, usage.missing_argument. Branch on that, or on the exit status. The message is prose and changes.

Related