What are privileged accounts and standard accounts, and what permissions do they have - PolarDB

Overview

To ensure the security of cloud databases, you must manage and restrict user permissions. Users should only have the permissions required for their tasks and should not have any permissions beyond their scope. Therefore, the cloud database uses a role-based access control (RBAC) model to manage permissions for regular users. In this model, different users are assigned different roles, each role has specific permissions, and users are assigned to roles based on the operations they need to perform. This approach effectively controls user permissions and ensures database security.

Currently, the database provides two roles for users: privileged users and standard users.

Privileged users are primarily used for management tasks, such as creating databases, granting basic permissions, and creating publications and subscriptions.
Standard users are basic roles used to perform various business logic operations.

PolarDB uses this permission system to build database operation types, implements an access control model, and more effectively safeguards the permission security of cloud databases.

Privileged user permissions

Account type	Permissions
Privileged account	Create, update, access, and delete all non-system objects. These objects include basic objects such as tables, indexes, types, and views, as well as advanced objects such as functions and procedures. In addition, object permissions of all privileged users are shared. Any privileged user can access objects owned by other privileged users.
	Create databases. For more information, see Create a database.
	Create extensions. For more information, see Extensions.
	Create users with permissions no greater than your own. For more information, see Create a user.
	Create and use event triggers. For more information, see Create a trigger.
	Create and modify types. For more information, see Create an object type.
	Invoke garbage collection commands. For more information, see Garbage collection mechanism.
	Create and modify foreign data wrappers (FDWs). For more information, see Use oss_fdw to read and write external text files.
	Create publications and subscriptions. Example: `-- Create a publication CREATE PUBLICATION my_publication FOR TABLE test_t; -- Create a subscription CREATE SUBSCRIPTION my_subscription CONNECTION 'channel_name=XXXX dbname=XXXX user=XXXX password=XXXX' PUBLICATION my_publication;` Note A `channel` is required to create a subscription. To create a channel, see Network channels. If an error occurs when creating a subscription by using a network channel, see Contact us.
	Use two-phase transactions. Example: `-- session_1 begin; insert into t values (1,'a'); prepare transaction 'test_1'; -- session_2 commit prepared 'test_1'; -- Or roll back rollback prepared 'test_1';`
	Send signals. Example: `-- 4300 is a non-superuser process select pg_cancel_backend(4300); select pg_terminate_backend(4300);`
	View background process statuses. Example: `select * from pg_stat_activity;`

Standard user permissions

Account type	Permissions
Standard account	Connect to all databases.
Standard account	Query objects for which the account has been granted PUBLIC permissions.

Permissions unavailable to both privileged and standard users

Some permissions pose security risks to the database. Therefore, the following permissions are currently prohibited for all users.

Account type	Permissions
Privileged account/Standard account	Modify system parameters.
	Create tablespaces.
	Kill superuser processes.
	Execute untrusted languages. Note plpgsql is a trusted language. All other languages are untrusted and cannot be executed.

User group permissions

PolarDB for PostgreSQL is built on PostgreSQL and inherits certain PostgreSQL group roles. The following sections describe these group permissions in detail. These permissions and the privileged user permissions described above form a union — the final permission set is the combination of both.

Role name	Status	Description
pg_read_all_stats & pg_stat_scan_tables	Full	Statistics-related permissions. Fully owned.
pg_signal_backend	Full	Send signals to other processes. Fully owned.
pg_polar_superuser	Full	Privileged user group. Includes a comprehensive set of privileged user permissions. Fully owned.
pg_polar_replication	Full	Provides permissions for users to use streaming replication. Fully owned.
pg_monitor	Full	Monitoring permissions. Read and write access to local files is blocked.
pg_read_all_data & pg_write_all_data	Restricted	Read and write permissions for any table. Can read and write any user table and read most system tables. Access to some system tables is blocked for security reasons.
pg_read_all_settings	Restricted	Read permissions for any parameter. Can read parameters within the permission scope. Access to some parameters is blocked for security reasons.
pg_read_server_files & pg_write_server_files	Blocked	Read and write permissions for local files are not supported.
pg_execute_server_program	Blocked	Permissions to execute binary commands are not supported.