fix: Correct privilege validation for db_users

Author: jamesiarmes

README.md

@@ -250,10 +250,10 @@ database(s). The user will be assigned a randomly generated password, and their
 credentials will be stored in AWS Secrets Manager. The ARN of the secret for
 each user is available in the `db_user_secret_arns` output.
 
-| Name       | Description                                                                                                   | Type           | Default      | Required |
-| ---------- | ------------------------------------------------------------------------------------------------------------- | -------------- | ------------ | -------- |
-| databases  | List of databases to grant the user access to. If left empty, the user will not have access to any databases. | `list(string)` | `[]`         | no       |
-| privileges | Privileges to grant on the databases for the user. The only valid value is `"readonly"`.                      | `string`       | `"readonly"` | no       |
+| Name       | Description                                                                              | Type           | Default      | Required |
+| ---------- | ---------------------------------------------------------------------------------------- | -------------- | ------------ | -------- |
+| databases  | List of databases to grant the user access to.                                           | `list(string)` | n/a          | yes      |
+| privileges | Privileges to grant on the databases for the user. The only valid value is `"readonly"`. | `string`       | `"readonly"` | no       |
 
 ### iam_db_users
 

variables.tf

@@ -144,9 +144,9 @@ variable "db_users" {
   validation {
     condition = alltrue([
       for _, user in var.db_users :
-      contains(["all", "readonly"], user.privileges)
+      user.privileges == "readonly"
     ])
-    error_message = "Database user privileges must be \"all\" or \"readonly\"."
+    error_message = "Database user privileges must be \"readonly\"; only read-only access is supported for db_users."
   }
 }