PostgreSQL
TMA-POSTGRES-4.3
Ensure excessive administrative privileges are revoked
HighLevel 1Manual reviewpostgres
Description
With respect to PostgreSQL administrative SQL commands, only superusers should have elevated privileges. PostgreSQL regular, or application, users should not possess the ability to create roles, create new databases, manage replication, or perform any other action deemed privileged.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Run psql -c "\du+" and review role attributes (Superuser, Create role, Create DB, Replication, Bypass RLS). Only designated administrative roles may hold them; any regular role with administrative attributes is a fail.
How it is fixed
Fix method: Guidance or infrastructure patch
Revoke unneeded attributes, e.g. ALTER ROLE <role> NOSUPERUSER NOCREATEROLE NOCREATEDB NOREPLICATION NOBYPASSRLS;
Properties
- Operating systems
- Any
- Tags
- postgresdatabaseauthorizationmanual
- Reference
- CIS PostgreSQL 18 Benchmark v1.0.0 - 4.3 Ensure excessive administrative privileges are revoked