Project: YugabyteDB (App Definition and Development / Database)
File: cloud-users.md

title: Database authorization linkTitle: Database authorization description: The default YugabyteDB users and roles available in YugabyteDB Managed clusters. headcontent: Default YugabyteDB users and roles in YugabyteDB Managed clusters menu: preview_yugabyte-cloud: identifier: cloud-users parent: cloud-secure-clusters weight: 300 type: docs To manage database access and authorization, YugabyteDB uses (RBAC), consisting of a collection of privileges on resources given to roles. (For information on managing your YugabyteDB Managed account users, refer to .) The YugabyteDB database on your YugabyteDB Managed cluster includes a set of default users and roles in YSQL and YCQL. To view the roles in your cluster, enter the following command: ```sql yugabyte=> \du ``` ```output List of roles Role name | Attributes | Member of --++ admin | Create role, Create DB, Bypass RLS | {yb_superuser} postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {} ybdbadmin | No inheritance, Cannot login | {} yb_extension | Cannot login | {} yb_fdw | Cannot login | {} ybsuperuser | Create role, Create DB, Cannot login, Bypass RLS | {pgreadallstats,pgsignalbackend,ybextension,ybdb_admin} yugabyte | Superuser, Create role, Create DB, Replication, Bypass RLS | {} ``` The following table describes the default YSQL roles and users in YugabyteDB Managed clusters. <!-- Portions of this table are also under RBAC in core docs --> | Role | Description | | | | | | The default user for your cluster. If you added your own credentials during cluster creation, the user name will be the one you provided. Although not a superuser, this role is a member of ybsuperuser, and you can use it to perform database operations, create other ybsuperuser users, create extensions, and manage your cluster. | | postgres | Superuser role created during database creation. Not available to YugabyteDB Managed users. | | | Role that allows non-superuser users to create tablespaces and perform other privileged operations. | | | Role that allows non-superuser users to create PostgreSQL

| | yb_fdw | Role that allows non-superuser users to , , and . | | | YugabyteDB Managed only role. This role is assigned to the default cluster user (that is, admin) to perform all the required operations on the database, including creating other ybsuperuser users. For security reasons, ybsuperuser doesn't have YugabyteDB superuser privileges. | | yugabyte | Superuser role used during database creation, by Yugabyte support to perform maintenance operations, and for backups (ysql_dumps). Not available to YugabyteDB Managed users. | When creating a YugabyteDB cluster in YugabyteDB Managed, you set up the credentials for your database admin user. For security reasons, this user does not have YugabyteDB superuser privileges; it is instead a member of `yb_superuser`, a role specific to YugabyteDB Managed clusters. Although not a superuser, `ybsuperuser` includes sufficient privileges to perform all the required operations on a database, including creating other ybsuperuser users, as follows: Has the following role options: `INHERIT`, `CREATEROLE`, `CREATEDB`, and `BYPASSRLS`. Member of the following roles: `pgreadallstats`, `pgsignalbackend`, `ybdb_admin`, and . `yb_superuser` is the highest privileged role you have access to in YugabyteDB Managed. You can't delete, change the passwords, or login using the `postgres` or `yugabyte` superuser roles. The `ybdbadmin` role is specific to YugabyteDB Managed clusters and allows non-superuser roles to perform a number of privileged operations in a manner similar to a superuser, such as performing operations on objects it does not own. `ybsuperuser` and, by extension, the default database admin user, is a member of `ybdb_admin`. The `ybextension` role allows non-superuser roles to . A user granted this role can create all the extensions that are bundled in YugabyteDB. `ybsuperuser` and, by extension, the default database admin user, is a member of `yb_extension`. In YCQL, there is a single superuser called `cassandra` used during database creation. The default user (by default, `admin`) added when you created the cluster has superuser privileges in YCQL. As a superuser, you can delete the cassandra user if you choose to.