Hitchhiker's Guide to Row-Level Security in Citus
summary
Shows how Postgres RLS behaves in real Citus clusters: enabling RLS, FORCE ROW LEVEL SECURITY to stop owner bypass, and that superusers or roles with bypass can ignore policies. Demonstrates two practical patterns — role-based policies (one DB user per tenant) and SET LOCAL-based policies (my_app.company_id per transaction) — with a live demo that works but exposes a foreign-key side channel (inserts reveal hidden rows) and warns Citus <13.1 doesn't propagate SET LOCAL to all nodes.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:36Introduction - Row Level Security(RLS) in PostgreSQL & Citus
- 3:26Defining Row Level Security Policies
- 8:10Sharding with Citus - Elastic Clusters on Azure Database for PostgreSQL
- 12:30Row Level Security with Citus
- 16:26DEMO - Row Level Security Setup & Policies
related talks
18mEverything you need to know about Postgres Row Level Security
53mRow Level Security
47mRow Level Security Explained
42mData Security using Roles, Privileges and Row Level Security
26mDemystifying Postgres Foreign Key Constraints on Citus
40mExploiting PostgreSQL's power with Elixir / Ecto applications
25mSaaS on Rails on PostgreSQL
43mThe Role of Row Level Security in High-Load Projects