Anyone ever created a role for a dbforpostgresql.Server? How? Especially hard when you can't reach it after deploy via internet...

pulumi-postgresql provider works great but obviously needs to be able to connect to the server as there isn't a facility for running SQL commands on the Postgres server via an API. I guess you're left with the following options: • Running Pulumi operations in a CI/CD runner hosted within the same Azure network boundaries • Jumpbox VM within the vnet + IP whitelisting – sub-optimal from a security standpoint • Connecting via client VPN, better than jumpbox or IP Whitelisting but requires DNS forwarding for resolving private DNS