Just some thoughts-

Based on the syntax of GRANT, would it make more sense to trigger on user = "PUBLIC" rather than have to write extra special-case code for group = "public".

Should the comparison for "public" be case-insensitive?

https://docs.aws.amazon.com/redshift/latest/dg/r_GRANT.html

PUBLIC
Grants the specified privileges to all users, including users created later. PUBLIC represents a group that always includes all users. An individual user's privileges consist of the sum of privileges granted to PUBLIC, privileges granted to any groups that the user belongs to, and any privileges granted to the user individually.

As it represents a group I think this implementation is correct and using USER=PUBLIC might be misleading and not consistent with PostgreSQL and Redshift implementation and naming.

With RBAC implementation in provider this will be also useful.

The postgresql provider does this as a part of the role resource - which seems to more or less approximate a user. I'm really not arguing for either way being right, just wanted to point it out - the code looked a little awkward.

@mtesch-um thank you for the feedback.

I decided to use a group as the GRANT documentation for both PostgreSQL and Redshift says:

PUBLIC represents a group that always includes all users.

The code would not really change whether it will be a user or group. It's due to how the permissions for PUBLIC are represented in Redshift. If you take a look at pg_namespace, ACLs for schemas are:

• group <name>=UC/rdsdb for groups,
• <username>=UC/rdsdb for users,
• =UC/rdsdb for PUBLIC (nothing before the equal sign)

I had to modify the query to avoid accidentally catching users/groups ACLs. I tried fitting it to existing queries but that was just causing more problems.

Vanilla PostgreSQL is different in this case as it does not have a separation for users and groups in newer versions, where a role combines both (can be given a password to imitate a user and can be assigned other roles to form "groups"). Redshift is slowly heading that way too with RBAC.