sidenote: Azure's PostgreSQL doesn't provide you with superuser, and afaict, you cannot assign pg_read_all_data / pg_write_all_data without it.

Most "managed" Postgres' are like that.

https://neon.com/docs/manage/roles

this is same with GCP Cloud SQL and RDS (there I need to double check). They really don't want you to access the underlying FS.

Correct

Nice. Funny how many ways there are to make Postgres sessions/connections effectively read only.