--- title: "Database authorization" url: "https://docs.yugabyte.com/stable/yugabyte-cloud/cloud-secure-clusters/cloud-users/" --- # Database authorization The default YugabyteDB users and roles available in YugabyteDB Aeon clusters. Default YugabyteDB users and roles in YugabyteDB Aeon clusters To manage database access and authorization, YugabyteDB uses [role-based access control](/stable/secure/authorization/ "role-based access control") (RBAC), consisting of a collection of privileges on resources given to roles. (For information on managing your YugabyteDB Aeon account users, refer to [Manage account users](/stable/yugabyte-cloud/managed-security/manage-access/ "Manage account users").) The YugabyteDB database on your YugabyteDB Aeon cluster includes a set of default users and roles in YSQL and YCQL. ## YSQL default roles and users To view the roles in your cluster, enter the following command: ```sql yugabyte=> \du ``` ```output List of roles Role name | Attributes | Member of --------------+------------------------------------------------------------+--------------------------------------------------------------- admin | Create role, Create DB, Replication, Bypass RLS | {yb_superuser} postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {} yb_db_admin | No inheritance, Cannot login | {} yb_extension | Cannot login | {} yb_fdw | Cannot login | {} yb_superuser | Create role, Create DB, Cannot login, Bypass RLS | {pg_read_all_stats,pg_signal_backend,yb_extension,yb_db_admin} yugabyte | Superuser, Create role, Create DB, Replication, Bypass RLS | {} ``` The following table describes the default YSQL roles and users in YugabyteDB Aeon clusters. | Role | Description | |---------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [admin](#admin-and-yb-superuser "admin") | The default user for your cluster. If you added your own credentials during cluster creation, the user name will be the one you provided. Although not a superuser, this role is a member of yb\_superuser, and you can use it to perform database operations, create other yb\_superuser users, create extensions, and manage your cluster. | | postgres | Superuser role created during database creation. Not available to YugabyteDB Aeon users. | | [yb\_db\_admin](#yb-db-admin "yb_db_admin") | Role that allows non-superuser users to create tablespaces and perform other privileged operations. | | [yb\_extension](#yb-extension "yb_extension") | Role that allows non-superuser users to create PostgreSQL extensions. | | yb\_fdw | Role that allows non-superuser users to [CREATE](/stable/api/ysql/the-sql-language/statements/ddl_create_foreign_data_wrapper/ "CREATE"), [ALTER](/stable/api/ysql/the-sql-language/statements/ddl_alter_foreign_data_wrapper/ "ALTER"), and [DROP](/stable/api/ysql/the-sql-language/statements/ddl_drop_foreign_data_wrapper/ "DROP") [foreign data wrappers](/stable/explore/ysql-language-features/advanced-features/foreign-data-wrappers/ "foreign data wrappers"). | | [yb\_superuser](#admin-and-yb-superuser "yb_superuser") | YugabyteDB Aeon only role. This role is assigned to the default cluster user (that is, admin) to perform all the required operations on the database, including creating other yb\_superuser users. For security reasons, yb\_superuser doesn't have YugabyteDB superuser privileges. | | yugabyte | Superuser role used during database creation, by Yugabyte support to perform maintenance operations, and for backups (ysql\_dumps). Not available to YugabyteDB Aeon users. | ### Admin and yb\_superuser When creating a YugabyteDB cluster in YugabyteDB Aeon, you set up the credentials for your database admin user. For security reasons, this user does not have YugabyteDB superuser privileges; it is instead a member of `yb_superuser`, a role specific to YugabyteDB Aeon clusters. Although not a superuser, `yb_superuser` includes sufficient privileges to perform all the required operations on a database, including creating other yb\_superuser users, as follows: - Has the following role attributes: `INHERIT`, `CREATEROLE`, `CREATEDB`, `REPLICATION`, and `BYPASSRLS`. - Member of the following roles: `pg_read_all_stats`, `pg_signal_backend`, `yb_db_admin`, and [yb\_extension](#yb-extension "yb_extension"). `yb_superuser` is the highest privileged role you have access to in YugabyteDB Aeon. You can't delete, change the passwords, or login using the `postgres` or `yugabyte` superuser roles. To create another database admin user with the same attributes, grant the `yb_superuser` role. For example: ```sql CREATE ROLE my_dbadmin WITH CREATEROLE CREATEDB BYPASSRLS LOGIN PASSWORD 'password'; GRANT yb_superuser to my_dbadmin; ``` To add the REPLICATION attribute to a role, you must use the `enable_replication_role()` function; refer to [Manage CDC](/stable/yugabyte-cloud/cloud-clusters/aeon-cdc/#manage-cdc "Manage CDC"). ### yb\_db\_admin The `yb_db_admin` role is specific to YugabyteDB Aeon clusters and allows non-superuser roles to perform a number of privileged operations in a manner similar to a superuser, such as performing operations on objects it does not own. `yb_superuser` and, by extension, the default database admin user, is a member of `yb_db_admin`. ### yb\_extension The `yb_extension` role allows non-superuser roles to [create extensions](/stable/yugabyte-cloud/cloud-clusters/add-extensions/ "create extensions"). A user granted this role can create all the extensions that are bundled in YugabyteDB. `yb_superuser` and, by extension, the default database admin user, is a member of `yb_extension`. ## YCQL default roles and users In YCQL, there is a single superuser called `cassandra` used during database creation. The default user (by default, `admin`) added when you created the cluster has superuser privileges in YCQL. As a superuser, you can delete the cassandra user if you choose to. ## Learn more - [Manage Users and Roles in YugabyteDB](/stable/secure/authorization/create-roles/ "Manage Users and Roles in YugabyteDB") - [Role-based access control](/stable/secure/authorization/ "Role-based access control") - [PostgreSQL extensions](/stable/additional-features/pg-extensions/ "PostgreSQL extensions") - [Create YSQL extensions in YugabyteDB Aeon](/stable/yugabyte-cloud/cloud-clusters/add-extensions/ "Create YSQL extensions in YugabyteDB Aeon") ## Next step - [Add database users](/stable/yugabyte-cloud/cloud-secure-clusters/add-users/ "Add database users")