Project: StarRocks (App Definition and Development / Database)
File: REVOKE.md

displayed_sidebar: "English" Revokes specific privileges or roles from a user or a role. For the privileges supported by StarRocks, see . :::tip Common users can only revoke their privileges that have the `WITH GRANT OPTION` keyword from other users and roles. For information about `WITH GRANT OPTION`, see . Only users with the `user_admin` role has the privilege to revoke privileges from other users. ::: The privileges that can be revoked are object-specific. The following part describes syntax based on objects. ```SQL REVOKE { CREATE RESOURCE GROUP | CREATE RESOURCE | CREATE EXTERNAL CATALOG | REPOSITORY | BLACKLIST | FILE | OPERATE } ON SYSTEM FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE { ALTER | DROP | ALL [PRIVILEGES] } ON { RESOURCE GROUP <resourcegroupname> [, <resourcegroupname>,...] ALL RESOURCE GROUPS} FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE { USAGE | ALTER | DROP | ALL [PRIVILEGES] } ON { RESOURCE <resourcename> [, <resourcename>,...] ALL RESOURCES} FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE IMPERSONATE ON USER <useridentity> FROM USER <useridentity>; ``` ```SQL REVOKE { USAGE | DROP | ALL [PRIVILEGES]} ON { GLOBAL FUNCTION <functionname> [, <functionname>,...] | ALL GLOBAL FUNCTIONS } FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE { USAGE | CREATE DATABASE | ALL [PRIVILEGES]} ON CATALOG default_catalog FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE { USAGE | DROP | ALL [PRIVILEGES] } ON { CATALOG <catalogname> [, <catalogname>,...] | ALL CATALOGS} FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE { ALTER | DROP | CREATE TABLE | CREATE VIEW | CREATE FUNCTION | CREATE MATERIALIZED VIEW | ALL [PRIVILEGES] } ON {{ DATABASE <databasename> [, <databasename>,...]} | ALL DATABASES } FROM { ROLE | USER} {<rolename>|<useridentity>} ``` You must first run SET CATALOG before you run this command. ```SQL REVOKE { ALTER | DROP | SELECT | INSERT | EXPORT | UPDATE | DELETE | ALL [PRIVILEGES]} ON { TABLE <tablename> [, < tablename >,...] | ALL TABLES} IN { { DATABASE <databasename> [, <databasename>,...]} | ALL DATABASES } FROM { ROLE | USER} {<rolename>|<useridentity>} ``` You must first run SET CATALOG before you run this command. You can also use db.tbl to represent a table. ```SQL REVOKE <priv> ON TABLE db.tbl FROM {ROLE <rolename> | USER <useridentity>} ``` ```SQL REVOKE { ALTER | DROP | SELECT | ALL [PRIVILEGES]} ON { VIEW <viewname> [, < viewname >,...] ALL VIEWS} IN { { DATABASE <databasename> [,

| ALL DATABASES } FROM { ROLE | USER} {<rolename>|<useridentity>} ``` You must first run SET CATALOG before you run this command. You can also use db.view to represent a view. ```SQL REVOKE <priv> ON VIEW db.view FROM {ROLE <rolename> | USER <useridentity>} ``` ```SQL REVOKE { SELECT | ALTER | REFRESH | DROP | ALL [PRIVILEGES]} ON { MATERIALIZED VIEW <mvname> [, < mvname >,...] ALL MATERIALIZED VIEWS} IN { { DATABASE <databasename> [, <databasename>,...] } | ALL [DATABASES] } FROM { ROLE | USER} {<rolename>|<useridentity>} ``` You must first run SET CATALOG before you run this command. You can also use db.mv to represent an mv. ```SQL REVOKE <priv> ON MATERIALIZED VIEW db.mv FROM {ROLE <rolename> | USER <useridentity>} ``` ```SQL REVOKE { USAGE | DROP | ALL [PRIVILEGES]} ON { FUNCTION <functionname> [, < functionname >,...] ALL FUNCTIONS} IN { { DATABASE <databasename> [, <databasename>,...] } | ALL DATABASES } FROM { ROLE | USER} {<rolename>|<useridentity>} ``` You must first run SET CATALOG before you run this command. You can also use db.function to represent a function. ```SQL REVOKE <priv> ON FUNCTION db.function FROM {ROLE <rolename> | USER <useridentity>} ``` ```SQL REVOKE CREATE STORAGE VOLUME ON SYSTEM FROM { ROLE | USER} {<rolename>|<useridentity>} REVOKE { USAGE | ALTER | DROP | ALL [PRIVILEGES] } ON { STORAGE VOLUME < name > [, < name >,...] ALL STORAGE VOLUME} FROM { ROLE | USER} {<rolename>|<useridentity>} ``` ```SQL REVOKE <rolename> [,<rolename>, ...] FROM ROLE <role_name> REVOKE <rolename> [,<rolename>, ...] FROM USER <user_identity> ``` | Parameter | Description | | | -- | | role_name | The role name. | | user_identity | The user identity, for example, 'jack'@'192.%'. | | resourcegroup_name | The resource group name | | resource_name | The resource name. | | function_name | The function name. | | catalog_name | The name of the external catalog. | | database_name | The database name. | | table_name | The table name. | | view_name | The view name. | | mv_name | The name of the materialized view. | Revoke the SELECT privilege on table `sr_member` from user `jack`: ```SQL REVOKE SELECT ON TABLE sr_member FROM USER 'jack'@'192.%' ``` Revoke the USAGE privilege on resource `sparkresource` from role `testrole`: ```SQL REVOKE USAGE ON RESOURCE 'sparkresource' FROM ROLE 'testrole'; ``` Revoke the role `example_role` from user `jack`: ```SQL REVOKE example_role FROM 'jack'@'%'; ``` Revoke the role `examplerole` from role `testrole`: ```SQL REVOKE examplerole FROM ROLE 'testrole'; ```