PolarDB:Account permissions

How it works

PolarDB implements a Resource Access Management (RAM) model. Rather than granting permissions to individual accounts directly, the model assigns accounts to roles. Each role defines what operations an account can perform.

• Privileged accounts handle database administration: creating databases, managing extensions, configuring replication, and creating other accounts.

• Standard accounts run business logic: reading and writing application data.

Reserve privileged accounts for administrative tasks. For application users, create standard accounts and grant only the permissions the application requires.

Privileged account permissions

The following operations are available to privileged accounts.

-- Create a publication
CREATE PUBLICATION my_publication FOR TABLE test_t;

-- Create a subscription
CREATE SUBSCRIPTION my_subscription
CONNECTION 'channel_name=XXXX dbname=XXXX user=XXXX password=XXXX'
PUBLICATION my_publication;

CREATE CONTEXT hr_context USING test_package;

-- Session 1: prepare the transaction
BEGIN;
INSERT INTO t VALUES (1, 'a');
PREPARE TRANSACTION 'test_1';

-- Session 2: commit or roll back
COMMIT PREPARED 'test_1';
-- Or roll back:
ROLLBACK PREPARED 'test_1';

-- Cancel a running query (process ID 4300)
SELECT pg_cancel_backend(4300);

-- Terminate the session for a process
SELECT pg_terminate_backend(4300);

Prohibited operations

The following operations are blocked for both privileged and standard accounts to protect the cluster from destructive changes that could affect stability or security for all users.

User group permissions

PolarDB for PostgreSQL (Compatible with Oracle) inherits predefined group roles from PostgreSQL. These group permissions have a union relationship with the permissions owned by privileged accounts — a privileged account holds the sum of its own permissions and the group role permissions listed here.

What's next

• Create a database

• Create a user

• Plug-ins

• Network channels