How to setup vault and Postgres in Google cloud to have the correct permissions?
Short Summary

You have to run an REASSIGN OWNED BY "$VAULT_USERNAME" TO "cloudsqlsuperuser" after the table/sequence/function creation process to reassign back to a the common role.

Longer Answer

Postgres 9.6 CREATE TABLE will by default create the table under the user's role. Because the vault user is designed to be a temporary credential, we need to also make sure that the objects created under the temporary roles are reassigned back to a common role of some kind. In the specific case I outlined in Google Cloud, we are going to reassign back to cloudsqlsuperuser. 

The one command I found to work is the REASSIGN OWNED BY current_user to "cloudsqlsuperuser" command that will then take all of the objects owned by that temporary user and assign back to that common role.

Bonus: liquibase config

I am using liquibase to do my migrations and this is in my change log to fix the permissions everytime we run a migration:

&lt;databaseChangeLog&gt;
    &lt;changeSet author="elindblom" id="fix-permissions" context="" logicalFilePath="fix-permissions" runAlways="true" runOrder="last"&gt;
        &lt;sqlFile path="baselines/sql/fix-permissions.sql" splitStatements="false" relativeToChangelogFile="true" stripComments="false"/&gt;
    &lt;/changeSet&gt;
   ... rest of your change logs after ...
&lt;/databaseChangeLog&gt;


The SQL looks like this:

REASSIGN OWNED BY current_user TO "cloudsqlsuperuser";


The changeSet runs after everything comes to completion and runs every-time. The very important bits are the runAlways and runOrder elements.