TODO: 1 vault_database_secret_backend_connection per database

hashicorp-vault/iac/modules/app_roles/main.tf

@@ -27,8 +27,8 @@ resource "vault_database_secret_backend_role" "role" {
     "GRANT ${local.name}_role TO \"{{name}}\";",
   ]
   revocation_statements = [
-    "REASSIGN OWNED BY \"{{name}}\" TO ${local.name}_role;",
-    "REVOKE ALL ON DATABASE ${local.database} FROM  \"{{name}}\";", # should we drop the role ?
+    "REASSIGN OWNED BY \"{{name}}\" TO ${local.name}_role;", # reassign must be executed in the database where the reassgined objects are - TODO (one connection per database/app)
+    "REVOKE ALL ON DATABASE ${local.database} FROM  \"{{name}}\";", # should we drop the role ? -> YES after fixing reassign
   ]
   renew_statements    = []
   rollback_statements = []