How can Amazon RDS grant CREATE EXTENSION to their RDS_SUPERUSER role?
CREATE EXTENSION is not a grantable privilege. It is hard-coded who can create extensions.
In PostgreSQL, this is restricted to superusers, and from v13 on to users with the CREATE privileges on the database (if the extension is a &quot;trusted&quot; one).
Note, however, that RDS is different from PostgreSQL, and godJeff only knows how they hacked up the code.