Manage user privileges

This topic describes how to manage users, roles, and privileges in CelerData Cloud Serverless.

CelerData employs both role-based access control (RBAC) and identity-based access control (IBAC) to manage privileges within a CelerData cloud account, allowing account administrators to easily restrict privileges within the account on different granular levels.

Within a CelerData cloud account, privileges can be granted to users or roles. A role is a collection of privileges that can be assigned to users or other roles in the account as needed. A user can be granted one or more roles, which determine their permissions on different objects.

Manage users

Users with the system-defined role user_admin can create users, alter users, and drop users within the CelerData cloud account in the CelerData Cloud Serverless console. For more information, see Invite new users to your account.

Manage roles

Users with the system-defined role user_admin can create, grant, revoke, or drop roles in the CelerData cloud account.

Create a role

You can create a role using CREATE ROLE.

The following example creates the role example_role:

CREATE ROLE example_role;

Grant a role

You can grant roles to a user or another role using GRANT.

• Grant a role to a user.

  The following example grants the role example_role to the user jack:

  GRANT example_role TO USER jack;

• Grant a role to another role.

  The following example grants the role example_role to the role test_role:

  GRANT example_role TO ROLE test_role;

Revoke a role

You can revoke roles from a user or another role using REVOKE.

NOTE

You cannot revoke the system-defined default role PUBLIC from a user.

• Revoke a role from a user.

  The following example revokes the role example_role from the user jack:

  REVOKE example_role FROM USER jack;

• Revoke a role from another role.

  The following example revokes the role example_role from the role test_role:

  REVOKE example_role FROM ROLE test_role;

Drop a role

You can drop a role using DROP ROLE.

The following example drops the role example_role:

DROP ROLE example_role;

CAUTION

System-defined roles can not be dropped.

Manage privileges

Users with the system-defined role user_admin can grant or revoke privileges in the CelerData cloud account.

Grant privileges

You can grant privileges to a user or a role using GRANT.

• Grant a privilege to a user.

  The following example grants the SELECT privilege on the table sr_member to the user jack, and allows jack to grant this privilege to other users or roles (by specifying WITH GRANT OPTION in the SQL):

  GRANT SELECT ON TABLE sr_member TO USER jack WITH GRANT OPTION;

• Grant a privilege to a role.

  The following example grants the SELECT privilege on the table sr_member to the role example_role:

  GRANT SELECT ON TABLE sr_member TO ROLE example_role;

Revoke privileges

You can revoke privileges from a user or a role using REVOKE.

• Revoke a privilege from a user.

  The following example revokes the SELECT privilege on the table sr_member from the user jack, and disallows jack to grant this privilege to other users or roles):

  REVOKE SELECT ON TABLE sr_member FROM USER jack;

• Revoke a privilege from a role.

  The following example revokes the SELECT privilege on the table sr_member from the role example_role:

  REVOKE SELECT ON TABLE sr_member FROM ROLE example_role;

View user and role information

Users with the system-defined role user_admin can view all the user and role information within the CelerData cloud account.

View privilege information

You can view the privileges granted to a user or a role using SHOW GRANTS.

• View the privileges of the current user.

  SHOW GRANTS;

  NOTE

  Any user can view their own privileges without needing any privileges.

• View the privileges of a specific user.

  The following example shows the privileges of the user jack:

  SHOW GRANTS FOR jack;

• View the privileges of a specific role.

  The following example shows the privileges of the role example_role:

  SHOW GRANTS FOR ROLE example_role;

View user property

You can view the property of a user using SHOW PROPERTY.

The following example shows the property of the user jack:

SHOW PROPERTY FOR jack;

View roles

You can view all the roles within the CelerData cloud account using SHOW ROLES.

SHOW ROLES;

View users

You can view all the users within the CelerData cloud account using SHOW USERS.

SHOW USERS;