Project: StarRocks (App Definition and Development / Database)
File: GRANT.md

displayed_sidebar: "English" import UserPrivilegeCase from '../../../assets/commonMarkdown/userPrivilegeCase.md' Grants one or more privileges on specific objects to a user or a role. Grants roles to users or other roles. For more information about the privileges that can be granted, see . After a GRANT operation is performed, you can run to view detailed privilege information or run to revoke a privilege or role. Before a GRANT operation is performed, make sure that the related user or role has been created. For more information, see and . :::tip Only users with the `user_admin` role can grant any privilege to other users and roles. After a role is granted to a user, you must run to activate this role before you perform operations as this role. If you want all default roles to be activated upon login, run or . If you want all privileges in the system to be activated for all users upon login, set the global variable `SET GLOBAL activateallrolesonlogin = TRUE;`. Common users can only grant privileges that have the `WITH GRANT OPTION` keyword to other users and roles. ::: ```SQL GRANT { CREATE RESOURCE GROUP | CREATE RESOURCE | CREATE EXTERNAL CATALOG | REPOSITORY | BLACKLIST | FILE | OPERATE | CREATE STORAGE VOLUME } ON SYSTEM TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` ```SQL GRANT { ALTER | DROP | ALL [PRIVILEGES] } ON { RESOURCE GROUP <resourcegroupname> [, <resourcegroupname >,...] ALL RESOURCE GROUPS} TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` ```SQL GRANT { USAGE | ALTER | DROP | ALL [PRIVILEGES] } ON { RESOURCE <resourcename> [, < resourcename >,...] ALL RESOURCES} TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` ```SQL GRANT { USAGE | DROP | ALL [PRIVILEGES]} ON { GLOBAL FUNCTION <functionname>(inputdatatype) [, < functionname >(inputdatatype),...] | ALL GLOBAL FUNCTIONS } TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` Example: `GRANT usage ON GLOBAL FUNCTION a(string) to kevin;` ```SQL GRANT { USAGE | CREATE DATABASE | ALL [PRIVILEGES]} ON CATALOG default_catalog TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` ```SQL GRANT { USAGE | DROP | ALL [PRIVILEGES] } ON { CATALOG <catalogname> [, <catalogname>,...] | ALL CATALOGS} TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` ```SQL GRANT { ALTER | DROP | CREATE TABLE | CREATE VIEW | CREATE FUNCTION | CREATE MATERIALIZED VIEW | ALL [PRIVILEGES] } ON { DATABASE <databasename> [, <databasename>,...] | ALL DATABASES } TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` You must first run SET CATALOG before you run this command. For databases in an External Catalog, you can grant the CREATE TABLE privilege only on Hive (since v3.1) and Iceberg databases (since v3.2). ```SQL GRANT { ALTER | DROP | SELECT | INSERT | EXPORT | UPDATE | DELETE | ALL [PRIVILEGES]} ON { TABLE <tablename> [, < tablename >,...] | ALL TABLES} IN { { DATABASE <databasename> [, <databasename>,...] } | ALL DATABASES } TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` You must first run SET CATALOG before you run this command. You can also use `<dbname>.<tablename>` to represent a table. You can grant the SELECT privilege on all tables in Internal and External Catalogs to read data from these tables. For tables in Hive and Iceberg Catalogs, you can grant the INSERT privilege to write data into such tables (supported since

for Iceberg and v3.2 for Hive) ```SQL GRANT <priv> ON TABLE <dbname>.<tablename> TO {ROLE <rolename> | USER <username>} ``` ```SQL GRANT { ALTER | DROP | SELECT | ALL [PRIVILEGES]} ON { VIEW <viewname> [, < viewname >,...] ALL VIEWS} IN { { DATABASE <databasename> [, <databasename>,...] } | ALL DATABASES } TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` You must first run SET CATALOG before you run this command. You can also use `<dbname>.<viewname>` to represent a view. For tables in an External Catalog, you can only grant the SELECT privilege on Hive table views (since v3.1). ```SQL GRANT <priv> ON VIEW <dbname>.<viewname> TO {ROLE <rolename> | USER <username>} ``` ```SQL GRANT { SELECT | ALTER | REFRESH | DROP | ALL [PRIVILEGES]} ON { MATERIALIZED VIEW <mvname> [, < mvname >,...] ALL MATERIALIZED VIEWS} IN { { DATABASE <databasename> [, <databasename>,...] } | ALL DATABASES } TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` You must first run SET CATALOG before you run this command. You can also use `<dbname>.<mvname>` to represent an mv. ```SQL GRANT <priv> ON MATERIALIZED VIEW <dbname>.<mvname> TO {ROLE <rolename> | USER <username>} ``` ```SQL GRANT { USAGE | DROP | ALL [PRIVILEGES]} ON { FUNCTION <functionname>(inputdatatype) [, < functionname >(inputdatatype),...] ALL FUNCTIONS} IN { { DATABASE <databasename> [, <databasename>,...] } | ALL DATABASES } TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` You must first run SET CATALOG before you run this command. You can also use `<dbname>.<functionname>` to represent a function. ```SQL GRANT <priv> ON FUNCTION <dbname>.<functionname> TO {ROLE <rolename> | USER <username>} ``` ```SQL GRANT IMPERSONATE ON USER <user_identity> TO USER <useridentity1> [ WITH GRANT OPTION ] ``` ```SQL GRANT { USAGE | ALTER | DROP | ALL [PRIVILEGES] } ON { STORAGE VOLUME < name > [, < name >,...] ALL STORAGE VOLUMES} TO { ROLE | USER} {<rolename>|<useridentity>} [ WITH GRANT OPTION ] ``` ```SQL GRANT <rolename> [,<rolename>, ...] TO ROLE <role_name> GRANT <rolename> [,<rolename>, ...] TO USER <user_identity> ``` Example 1: Grant the privilege to read data from all tables in all databases to user `jack`. ```SQL GRANT SELECT ON . TO 'jack'@'%'; ``` Example 2: Grant the privilege to load data into all tables of database `db1` to role `my_role`. ```SQL GRANT INSERT ON db1.* TO ROLE 'my_role'; ``` Example 3: Grant the privileges to read, update, and load data into table `tbl1` of database `db1` to user `jack`. ```SQL GRANT SELECT,ALTER,INSERT ON db1.tbl1 TO 'jack'@'192.8.%'; ``` Example 4: Grant the privilege to use all the resources to user `jack`. ```SQL GRANT USAGE ON RESOURCE * TO 'jack'@'%'; ``` Example 5: Grant the privilege to use resource `spark_resource` to user `jack`. ```SQL GRANT USAGE ON RESOURCE 'spark_resource' TO 'jack'@'%'; ``` Example 6: Grant the privilege to use resource `sparkresource` to role `myrole`. ```SQL GRANT USAGE ON RESOURCE 'sparkresource' TO ROLE 'myrole'; ``` Example 7: Grant the privilege to read data from table `sr_member` to user `jack` and allow user `jack` to grant this privilege to other users or roles (by specifying WITH GRANT OPTION). ```SQL GRANT SELECT ON TABLE sr_member TO USER jack@'172.10.1.10' WITH GRANT OPTION; ``` Example 8: Grant system-defined roles `dbadmin`, `useradmin`, and `clusteradmin` to user `userplatform`. ```SQL GRANT dbadmin, useradmin, clusteradmin TO USER userplatform; ``` Example 9: Allow user `jack` to perform operations as user `rose`. ```SQL GRANT IMPERSONATE ON USER 'rose'@'%' TO USER 'jack'@'%'; ``` <UserPrivilegeCase /> For the best practices of multi-service access control, see .