Manage custom roles

[Edit this page](https://github.com/ClickHouse/clickhouse-docs/blob/main/docs/cloud/guides/security/01_cloud_access_management/03_manage-custom-roles.md)

This guide is intended for users with the Admin role in ClickHouse Cloud.

ClickHouse Cloud customers may select from pre-defined system roles or create custom roles to assign to users. For more information on system roles and their associated permissions, review [Console roles and permissions](/docs/cloud/security/console-roles). This guide provides details for managing custom roles.

## Create custom roles[​](#create-custom-role "Direct link to Create custom roles")

Custom roles can contain a combination of organization, service, and database permissions. Permissions may be applied to all or a subset of services and databases.

Access organization settings and select Users and roles

### Access organization settings and select Users and roles[​](#users-and-roles-1 "Direct link to Access organization settings and select Users and roles")

From the services page, select the name of your organization. Select the `Users and roles` menu item from the popup menu.

Select the tab

### Select the `Roles` tab[​](#roles-tab "Direct link to roles-tab")

Select the `Roles` tab from the top middle of the screen.

Select from the upper right

### Select `Create new role` from the upper right[​](#create-new-role "Direct link to create-new-role")

Select the `Create new role` button in the upper right of the screen.

Name the role

### Name the role[​](#name-the-role "Direct link to Name the role")

Enter a descriptive role name. This will be the name you will see when assigning roles to users and API keys.

Click and select permission scope

### Click `Allow` and select permission scope[​](#scope-permissions "Direct link to scope-permissions")

Click the `Allow` button and select from Organization, Service, and/or Database permissions. For a description of all permissions, see [Console roles and permissions](/docs/cloud/security/console-roles).

Tip

Ensure users who will log into the console have a minimum of Organization > Access organization permissions.

Review your new role

### Review your new role[​](#review-role "Direct link to Review your new role")

Review permissions assigned to your new role before finalizing. Click `Create role` when done.

## Update custom roles[​](#update-custom-role "Direct link to Update custom roles")

Custom roles may be updated after they're created. Users will lose any permissions removed from the role and will gain any permissions added.

Tip

User permissions are additive. If a user has permission to perform an operation as part of multiple roles, they may not immediately lose access if permission is removed from only one role.

1. Access organization settings and select `Users and roles`
2. Select the `Roles` tab
3. Select the three dots next to the role you would like to update
4. Select `Edit`
5. Modify the permissions
6. Select `Edit role`

## Delete custom roles[​](#delete-custom-role "Direct link to Delete custom roles")

Custom roles may be deleted at any time.

Note

You must have at least one user in the organization with administrative permissions. If deleting the role removes administrative permissions from the last user, you can't delete it. To resolve this, assign at least one user the Admin system role before deleting the custom role.

1. Access organization settings and select `Users and roles`
2. Select the `Roles` tab
3. Select the three dots next to the role you would like to delete
4. Review the users and API keys that will lose access when the role is removed. Adjust assignments as needed.
5. Select `Delete role` to complete the process

- [Create custom roles](#create-custom-role)
  - [Access organization settings and select Users and roles](#users-and-roles-1)- [Select the `Roles` tab](#roles-tab)- [Select `Create new role` from the upper right](#create-new-role)- [Name the role](#name-the-role)- [Click `Allow` and select permission scope](#scope-permissions)- [Review your new role](#review-role)- [Update custom roles](#update-custom-role)- [Delete custom roles](#delete-custom-role)

Was this page helpful?