I am evaluating TimescaleDB as a replacement for Prometheus and InfluxDB.
I understand that each Telegraf instance would connect with a normal PostgreSQL user account in order to send the data to be ingested.
Is there a way to grant such a PostgreSQL user account minimal permissions, so that data can only be inserted but not queried or modified? Otherwise, it could be considered a security risk. I couldn't find anything along this line in the documentation.
At first I thought about just granting INSERT permission for the target tables. A Telegraf agent will probably need to insert metrics into many different tables, so that may become unwieldy.
Another potential source of trouble is that Telegraf seems able to create the target table if it does not exist, via a creation template. So it may need more permissions than you would normally expect.
I am evaluating TimescaleDB as a replacement for Prometheus and InfluxDB.
I understand that each Telegraf instance would connect with a normal PostgreSQL user account in order to send the data to be ingested.
Is there a way to grant such a PostgreSQL user account minimal permissions, so that data can only be inserted but not queried or modified? Otherwise, it could be considered a security risk. I couldn't find anything along this line in the documentation.
At first I thought about just granting INSERT permission for the target tables. A Telegraf agent will probably need to insert metrics into many different tables, so that may become unwieldy.
Another potential source of trouble is that Telegraf seems able to create the target table if it does not exist, via a creation template. So it may need more permissions than you would normally expect.