3 ms·

The problem came from fat-fingering a command for DB maintenance while running as an admin. This then ran scripts intended for a development environment. (Devel

The problem came from fat-fingering a command for DB maintenance while running as an admin. This then ran scripts intended for a development environment. (Development environments don't need to be careful about destroying stuff). I suggest ideally all the maintenance tasks can be done automatically, without needing the command to be run manually. Such scripts can then run in staging before in prod; or if the scripts necessarily only apply to prod, they should be reviewed carefully. If prod admin must be done manually, then make you could make it harder to run the development scripts with such admin privileges.

yebyen 6y ago
But there is a release phase in Heroku, and reasonably that's the only time you should expect to need DDL permissions... The principle of least required privilege seems to suggest that the production web server shouldn't have permission to perform DDL when it doesn't need it (so that fat-finger would have likely never happened, or never caused a problem, so long as it was only running in the context of the prod web service.) It's just a little bit surprising that there don't seem to be any concrete solutions for this, I find it hard to believe I'm the first to whine about this issue related to commonly understood DBA best-practices. I don't know how you solve it, (maybe add a production_migrations environment?)