Add database users

When you create a cluster in YugabyteDB Aeon, you set up the database admin credentials, which you use to access the YugabyteDB database installed on your cluster. Use this account to:

• add more database users
• assign privileges to users
• change your password, or the passwords of other users

YugabyteDB uses role-based access control (RBAC) to manage database authorization. A database user's access is determined by the roles they are assigned. You should grant database users only the privileges that they require.

Create and manage users and roles

To manage database users, first connect to your cluster using Cloud Shell or a client shell.

To create and manage database roles and users (users are roles with login privileges), use the following statements:

Create a database user

Add database users as follows:

1. Add the user using the CREATE ROLE statement.
2. Grant the user any roles they require using the GRANT statement.
3. Authorize their network so that they can access the cluster. Refer to Assign IP allow lists.
4. Send them the credentials.

{{< note title="Database users and case sensitivity" >}}

Like SQL and CQL, both YSQL and YCQL are case-insensitive by default. When specifying an identifier, such as the name of a table or role, YSQL and YCQL automatically convert the identifier to lowercase. For example, CREATE ROLE Alice creates the role "alice". To use a case-sensitive name, enclose the name in quotes. For example, to create the role "Alice", use CREATE ROLE "Alice".

{{< /note >}}

YSQL

To add a database user in YSQL, use the CREATE ROLE statement as follows:

yugabyte=# CREATE ROLE <username> WITH LOGIN PASSWORD '<password>';

To grant a role to a user, use the GRANT statement as follows:

yugabyte=# GRANT <rolename> TO <username>;

{{< note title="Superuser in YugabyteDB Aeon" >}} You can't create YSQL superusers in YugabyteDB Aeon. To create another database administrator, grant the yb_superuser role, and alter the role to apply role attributes. Refer to Database authorization in YugabyteDB Aeon clusters. {{< /note >}}

YCQL

To add a database user in YCQL, use the CREATE ROLE statement as follows:

admin@ycqlsh> CREATE ROLE <username> WITH PASSWORD = '<password>' AND LOGIN = true;

To grant a role to a user, use the GRANT ROLE statement as follows:

admin@ycqlsh> GRANT ROLE <rolename> to <username>;

Change a user password

To change your own or another user's password, use the ALTER ROLE statement.

In YSQL, enter the following:

yugabyte=# ALTER ROLE <username> PASSWORD 'new-password';

In YCQL, enter the following:

cassandra@ycqlsh> ALTER ROLE <username> WITH PASSWORD = 'new-password';

Learn more

• Manage users and roles in YugabyteDB
• Database authorization in YugabyteDB Aeon clusters

Next steps

• Connect using a shell
• Connect an application