Amazon RDS and managed databases

Parallax works with Amazon RDS and other managed hosts. Connect with the endpoint’s name, which is the name the server’s certificate holds.

Encryption

By default Parallax encrypts when the server offers it, without checking the server’s certificate. To check it, download your provider’s CA bundle (for AWS, global-bundle.pem) and set, in the connection’s options:

Database	Settings
PostgreSQL	SSL mode: Verify full, and Root certificate file
MySQL	SSL mode: Verify full, and CA certificate file
SQL Server	Trust server certificate off, with the CA installed in Windows or the server’s own certificate as Server certificate file

Verify full checks that the certificate names the host you connect to; Verify CA checks only who issued it. On PostgreSQL, a test that fails on the host name says so: connect with the endpoint’s name, or use Verify CA.

See Engine options for every option.

Accounts with fewer rights

An account compares and deploys what its rights let it see. What it cannot see is left out on both sides. The comparison says so in a “Not everything was compared.” banner, naming the side, what was left out, and which right to grant:

• MySQL: SHOW_ROUTINE, TRIGGER, EVENT or SHOW VIEW
• SQL Server: VIEW DEFINITION

Encrypted SQL Server modules are left out the same way.

You can still deploy what the account could see. A deployment the account may not make fails with the server’s reason and changes nothing.

Parallax does not need access to the postgres database.

MySQL rehearsal

The rehearsal needs the right to create its scratch databases:

GRANT ALL ON `parallax\_preflight\_%`.* TO 'your_user'@'%';

Without it, a deployment stops before changing anything, unless rehearsing is unticked. See MySQL rehearsal.

On MySQL 8.0, grant a role’s rights on each database by name: 8.0 ignores a role’s grants on a database pattern.