Contact UsGet started
© 2024 Iron Hive LLC Belgrade

Managing PostgreSQL users

Written by
Updated at September 25, 2024

You can add and remove users, as well as manage their individual settings.

Warning

You can use SQL commands to assign privileges to users, but you cannot use them to add or change users. For more information, see Assigning privileges and roles to users.

Getting a list of users

  1. Go to the folder page and select Managed Service for PostgreSQL.
  2. Click the cluster name and select the Users tab.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To get a list of cluster users, run the following command:

yc managed-postgresql user list \
     --cluster-name <cluster_name>

You can request the cluster name with a list of clusters in the folder.

To get a list of cluster users, use the list REST API method for the User resource or the UserService/List gRPC API call and provide the cluster ID in the clusterId request parameter.

You can get the cluster ID with a list of clusters in the folder.

Creating a user

Warning

Granting the public table create privilege to new users depends on the PostgreSQL version:

  • 14 and lower: The privilege is granted automatically and cannot be revoked.
  • 15 and higher: The privilege is manually granted to the user.

  1. Go to the folder page and select Managed Service for PostgreSQL.

  2. Click the cluster name and open the Users tab.

  3. Click Create user.

  4. Enter the database username and password.

    Note

    The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter (except the pg_ combination), number, or underscore. The name may be up to 63 characters long.

    The names mysql, sys, information_schema, and performance_schema are reserved for Managed Service for MySQL. You cannot create users with these names.

    The password must be between 8 and 128 characters.

  5. Select the deletion protection type.

    The possible values include:

    • Same as cluster
    • Enabled
    • Disabled

  6. Select one or more databases that the user should have access to:

    1. In the Database field, click to the right of the drop-down list.
    2. Select the database from the drop-down list.
    3. Repeat the previous two steps until all the required databases are selected.
    4. To delete a database added by mistake, click to the right of the database name.

  7. Configure the DBMS settings for the user.

  8. Click Save.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To create a user in a cluster, run the command:

yc managed-postgresql user create <username> \
   --cluster-name <cluster_name> \
   --password=<password> \
   --permissions=<DB_list> \
   --conn-limit=<maximum_number_of_connections>

Where:

  • cluster-name: Cluster name.
  • password: User password.
  • permissions: List of DBs the user can access.
  • conn-limit: Maximum number of connections per user.

This command configures only the main user settings.

Note

The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter (except the pg_ combination), number, or underscore. The name may be up to 63 characters long.

The names mysql, sys, information_schema, and performance_schema are reserved for Managed Service for MySQL. You cannot create users with these names.

The password must be between 8 and 128 characters.

To customize the DBMS for the user, use the parameters described in User settings.

You can request the cluster name with a list of clusters in the folder.

  1. Open the current Terraform configuration file with an infrastructure plan.

    For more information about how to create this file, see Creating clusters.

    For a complete list of available Managed Service for PostgreSQL cluster user configuration fields, see the Terraform provider documentation.

  2. Add the yandex_mdb_postgresql_user resource:

    resource "yandex_mdb_postgresql_user" "<username>" {
  cluster_id = "<cluster_ID>"
  name       = "<username>"
  password   = "<password>"
  grants     = [ "<role1>","<role2>" ]
  login      = <permission_to_log_in_to_DB>
  conn_limit = <maximum_number_of_connections>
  deletion_protection = <deletion_protection>
  settings   = {
    <DB_settings>
  }
  permission {
    database_name = "<DB_name>"
  }
}

    Where:

    • login: Toggles the permission to log in to the DB. It may take either the true or false value.
    • deletion_protection: User deletion protection. It may take the true, false, or unspecified value (inherited from the cluster). The default value is unspecified.

    Note

    The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter (except the pg_ combination), number, or underscore. The name may be up to 63 characters long.

    The names mysql, sys, information_schema, and performance_schema are reserved for Managed Service for MySQL. You cannot create users with these names.

    The password must be between 8 and 128 characters.

  3. Make sure the settings are correct.

    1. Using the command line, navigate to the folder that contains the up-to-date Terraform configuration files with an infrastructure plan.

    2. Run the command:

      terraform validate

      If there are errors in the configuration files, Terraform will point to them.

  4. Confirm updating the resources.

    1. Run the command to view planned changes:

      terraform plan

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

    2. If you are happy with the planned changes, apply them:

      1. Run the command:

        terraform apply

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

To create a cluster user, use the create REST API method for the User resource or the UserService/Create gRPC API call and provide the following in the request:

  • ID of the cluster in which you want to create a user, in the clusterId parameter. To find out the cluster ID, get a list of clusters in the folder.

  • Username in the userSpec.name parameter.

  • User password in the userSpec.password parameter.

    Note

    The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter (except the pg_ combination), number, or underscore. The name may be up to 63 characters long.

    The names mysql, sys, information_schema, and performance_schema are reserved for Managed Service for MySQL. You cannot create users with these names.

    The password must be between 8 and 128 characters.

  • Deletion protection type in the deletionProtection parameter. The possible values are true and false. The default value is unspecified (inherited from the cluster).

  • One or more databases that the user must have access to, in one or more userSpec.permissions.databaseName parameters.

  • Maximum number of connections for the user in the userSpec.connLimit parameter.

Note

When created, the user only gets the CONNECT privilege for the selected databases and cannot perform any operations with the databases. To give the user access to the database, assign them the required privileges or roles.

Changing a password

  1. Go to the folder page and select Managed Service for PostgreSQL.
  2. Click the cluster name and open the Users tab.
  3. Click and select Change password.
  4. Set a new password and click Edit.

Note

The password must be between 8 and 128 characters.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To change the user's password, run the command:

yc managed-postgresql user update <username> \
    --cluster-name=<cluster_name> \
    --password=<new_password>

Note

The password must be between 8 and 128 characters.

You can request the cluster name with a list of clusters in the folder.

  1. Open the current Terraform configuration file with an infrastructure plan.

    For more information about how to create this file, see Creating clusters.

    For a complete list of available Managed Service for PostgreSQL cluster user configuration fields, see the Terraform provider documentation.

  2. Find the yandex_mdb_postgresql_user resource of the desired user.

  3. Change the value of the password field:

    resource "yandex_mdb_postgresql_user" "<username>" {
  ...
  name     = "<username>"
  password = "<new_password>"
  ...
}

    Note

    The password must be between 8 and 128 characters.

  4. Make sure the settings are correct.

    1. Using the command line, navigate to the folder that contains the up-to-date Terraform configuration files with an infrastructure plan.

    2. Run the command:

      terraform validate

      If there are errors in the configuration files, Terraform will point to them.

  5. Confirm updating the resources.

    1. Run the command to view planned changes:

      terraform plan

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

    2. If you are happy with the planned changes, apply them:

      1. Run the command:

        terraform apply

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

To update a cluster user's password, use the update REST API method for the User resource or the UserService/Update gRPC API call and provide the following in the request:

  • ID of the cluster in which the user is located, in the clusterId parameter. To find out the cluster ID, get a list of clusters in the folder.

  • Username in the userName parameter. To get the username, retrieve a list of users in the cluster.

  • New user password in the password parameter.

    Note

    The password must be between 8 and 128 characters.

  • List of user configuration fields to be changed (in this case, password) in the updateMask parameter.

Warning

This API method overrides all parameters of the object being modified that were not explicitly passed in the request to the default values. To avoid this, list the settings you want to change in the updateMask parameter (one line separated by commas).

Changing user settings

Note

The privileges and roles in PostgreSQL are not affected by these settings and are configured separately.

For information on setting up user privileges and roles, see Assigning privileges and roles to users.

  1. Go to the folder page and select Managed Service for PostgreSQL.
  2. Click the cluster name and open the Users tab.
  3. Click and select Configure.
  4. Set up user permissions to access certain databases:
    1. To grant access to the required databases:
      1. In the Database field, click to the right of the drop-down list.
      2. Select the database from the drop-down list.
      3. Repeat the previous two steps until all the required databases are selected.
    2. To revoke access to a specific database, click to the right of the database name.
  5. Click DBMS settings to change the maximum allowed number of connections for the user (Conn limit), enable/disable the user to connect to a cluster (Login), or update other PostgreSQL settings.
  6. Click Save.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

You can change the user settings from the command line interface:

  1. To set up the user's permissions to access certain databases, run the command, listing the database names in the --permissions parameter:

    yc managed-postgresql user update <username> \
    --cluster-name=<cluster_name> \
    --permissions=<DB_list>

    Where:

    • cluster-name: Cluster name.
    • permissions: List of DBs the user can access.

    You can request the cluster name with a list of clusters in the folder.

    This command grants the user access rights to the databases listed.

    To revoke access to a specific database, remove its name from the list and send the updated list to the command.

  2. To change the PostgreSQL settings for the user, pass their parameters in the command:

    yc managed-postgresql user update <username> \
     --cluster-name=<cluster_name> \
     --<setting_1>=<value_1> \
     --<setting_2>=<value_2> \
     --<setting_3>=<list_of_values> \
     ...

    You can change the connection limit for the user via the --conn-limit parameter.

    You can request the cluster name with a list of clusters in the folder.

  1. Open the current Terraform configuration file with an infrastructure plan.

    For more information about how to create this file, see Creating clusters.

    For a complete list of available Managed Service for PostgreSQL cluster user configuration fields, see the Terraform provider documentation.

  2. To grant the user permissions to access certain databases:

    1. Find the yandex_mdb_postgresql_user resource of the desired user.

    2. Add permission blocks with the appropriate DB names:

      resource "yandex_mdb_postgresql_user" "<username>" {
  ...
  name = "<username>"
  permission {
    database_name = "<DB_name>"
  }
  permission {
    database_name = "<DB_name>"
  }
  ...
}

  3. To revoke the user's permission to access a specific database, delete the permission block with the name of this DB from the configuration file.

  4. To change the PostgreSQL settings for the user, pass their parameters in the settings block:

    resource "yandex_mdb_postgresql_user" "<username>" {
  ...
  name     = "<username>"
  settings = {
    <DB_settings>
  }
  ...
}

  5. Make sure the settings are correct.

    1. Using the command line, navigate to the folder that contains the up-to-date Terraform configuration files with an infrastructure plan.

    2. Run the command:

      terraform validate

      If there are errors in the configuration files, Terraform will point to them.

  6. Confirm updating the resources.

    1. Run the command to view planned changes:

      terraform plan

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

    2. If you are happy with the planned changes, apply them:

      1. Run the command:

        terraform apply

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

To update a cluster user's settings, use the update REST API method for the User resource or the UserService/Update gRPC API call and provide the following in the request:

Warning

This API method overrides all parameters of the object being modified that were not explicitly passed in the request to the default values. To avoid this, list the settings you want to change in the updateMask parameter (one line separated by commas).

Configuring deletion protection

  1. Go to the folder page and select Managed Service for PostgreSQL.
  2. Click the cluster name and open the Users tab.
  3. Click and select Configure.
  4. Configure user deletion protection. To do this, select the relevant value in the Deletion protection field.
  5. Click Save.

  1. Open the current Terraform configuration file with an infrastructure plan.

  2. Find the yandex_mdb_postgresql_user resource of the desired user.

  3. Add the deletion_protection parameter. Possible values: true, false, or unspecified (inherited from the cluster). The default value is unspecified.

    resource "yandex_mdb_postgresql_user" "<username>" {
  ...
  deletion_protection = <deletion_protection>
  ...
}

  4. Make sure the settings are correct.

    1. Using the command line, navigate to the folder that contains the up-to-date Terraform configuration files with an infrastructure plan.

    2. Run the command:

      terraform validate

      If there are errors in the configuration files, Terraform will point to them.

  5. Confirm updating the resources.

    1. Run the command to view planned changes:

      terraform plan

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

    2. If you are happy with the planned changes, apply them:

      1. Run the command:

        terraform apply

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

To configure user deletion protection in a cluster, use the update REST API method for the User resource or the UserService/Update gRPC API call and provide the following in the request:

  • ID of the cluster in which the user is located, in the clusterId parameter. To find out the cluster ID, get a list of clusters in the folder.
  • Username in the userName parameter. To get the username, retrieve a list of users in the cluster.
  • updateMask parameter with the deletionProtection value.
  • New value of the deletionProtection parameter. The possible values are true and false. The default value is unspecified (inherited from the cluster).

Warning

This API method overrides all parameters of the object being modified that were not explicitly passed in the request to the default values. To avoid this, list the settings you want to change in the updateMask parameter (one line separated by commas).

Warning

Deletion protection only applies at specific user level. Deleting a cluster will delete all users, including those protected from deletion.

Deleting a user

A user can be protected against deletion. To delete such a user, disable the protection first.

To delete a user:

  1. Go to the folder page and select Managed Service for PostgreSQL.
  2. Click the cluster name and open the Users tab.
  3. Click and select Delete.
  4. Confirm the deletion.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To remove a user, run:

yc managed-postgresql user delete <username> \
   --cluster-name <cluster_name>

You can request the cluster name with a list of clusters in the folder.

To delete a user:

  1. Open the current Terraform configuration file with an infrastructure plan.

    For more information about how to create this file, see Creating clusters.

    For a complete list of available Managed Service for PostgreSQL cluster configuration fields, see the Terraform provider documentation.

  2. Delete the yandex_mdb_postgresql_user resource with the description of the desired user.

  3. Make sure the settings are correct.

    1. Using the command line, navigate to the folder that contains the up-to-date Terraform configuration files with an infrastructure plan.

    2. Run the command:

      terraform validate

      If there are errors in the configuration files, Terraform will point to them.

  4. Confirm updating the resources.

    1. Run the command to view planned changes:

      terraform plan

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

    2. If you are happy with the planned changes, apply them:

      1. Run the command:

        terraform apply

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

To delete a user, use the delete REST API method for the User resource or the UserService/Delete gRPC API call and provide the following in the request:

Examples

Add a user with read-only permissions

Alert

Do not use this example if a user is created using Terraform: subsequent changes made via Terraform may cancel the user's privileges granted through SQL.

To add a new user (user2) to an existing cluster with read-only access to the db1 database:

  1. Create a user named user2. Select the databases that the user should have access to.

  2. Connect to the db1 database under the account of the database owner.

  3. To only grant access rights to the Products table, in the default public schema, run the command:

    GRANT SELECT ON public.Products TO user2;

  4. To grant access to all the myschema schema tables, run the command:

    GRANT SELECT ON ALL TABLES IN SCHEMA myschema TO user2;
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA myschema to user2;

  5. (Optional) To change the default privileges, run this command:

    ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT ON TABLES TO user2;
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT USAGE, SELECT ON SEQUENCES TO user2;

To revoke the granted privileges, run the commands:

REVOKE SELECT ON public.Products FROM user2;

REVOKE SELECT ON ALL TABLES IN SCHEMA myschema FROM user2;
REVOKE USAGE ON SCHEMA myschema FROM user2;

You can grant user privileges via Terraform only in a cluster with public hosts.

User privileges are granted via Terraform using a third-party provider, Terraform Provider for PostgreSQL.

Note

Terraform Provider for PostgreSQL is not part of Managed Service for PostgreSQL. It is not covered by Yandex Cloud support and its usage is not governed by the Yandex Managed Service for PostgreSQL Terms of Use.

For more information about granting privileges, see Granting a privilege to a user.

Let's say you have a cluster named mypg with user1 as the owner. To add a new user (user2) to this cluster with read-only access to db1 tables with the public schema:

  1. Add a postgresql provider to the required_providers section in the provider configuration file:

    terraform {
  required_providers {
    ...
    postgresql = {
      source   = "cyrilgdn/postgresql"
    }
    ...
  }
}

  2. Open the Terraform configuration file with the infrastructure plan.

  3. Add the yandex_mdb_postgresql_user resource:

    resource "yandex_mdb_postgresql_user" "user2" {
  cluster_id      = yandex_mdb_postgresql_cluster.mypg.id
  name            = "user2"
  password        = "user2user2"
  permission {
    database_name = yandex_mdb_postgresql_database.db1.name
  }
}

  4. Add the postgresql provider and configure its access permissions to db1:

    provider "postgresql" {
  host            = yandex_mdb_postgresql_cluster.mypg.host[0].fqdn
  port            = 6432
  database        = yandex_mdb_postgresql_database.db1.name
  username        = yandex_mdb_postgresql_user.user1.name
  password        = yandex_mdb_postgresql_user.user1.password
}

  5. Add the postgresql_grant resource with the following attributes:

    resource "postgresql_grant" "readonly_tables" {
  database          = yandex_mdb_postgresql_database.db1.name
  role              = yandex_mdb_postgresql_user.user2.name
  object_type       = "table"
  privileges        = ["SELECT"]
  schema            = "public"
}

  6. Initialize Terraform once again:

    terraform init

  7. Make sure the settings are correct.

    1. Using the command line, navigate to the folder that contains the up-to-date Terraform configuration files with an infrastructure plan.

    2. Run the command:

      terraform validate

      If there are errors in the configuration files, Terraform will point to them.

  8. Confirm updating the resources.

    1. Run the command to view planned changes:

      terraform plan

      If the resource configuration descriptions are correct, the terminal will display a list of the resources to modify and their parameters. This is a test step. No resources are updated.

    2. If you are happy with the planned changes, apply them:

      1. Run the command:

        terraform apply

      2. Confirm the update of resources.

      3. Wait for the operation to complete.

To revoke the granted privilege, remove it from the privileges list and confirm updating the resources.

Previous
Managing databases
Next
Assigning privileges and roles