Manage roles

This page outlines how to create and manage roles in Materialize.

Create a role

To create a new role, use the CREATE ROLE statement:

CREATE ROLE <role_name> WITH <role_attribute>;

Materialize roles have the following available attributes:

Name Description
INHERIT Read-only. Can inherit privileges of other roles.

Alter a role’s attributes

To change a role’s attributes, use the ALTER ROLE statement:

ALTER ROLE <role_name> WITH <ATTRIBUTE>;

Grant a role to a user

To grant a role assignment to a user, use the GRANT statement:

GRANT <role_name> to <user_name>;

Remove a user from a role

To remove a user from a role, use the REVOKE statement:

REVOKE <role_name> FROM <user_name>;

Drop a role

To remove a role, use the DROP ROLE statement:

DROP ROLE <role_name>;

Builtin roles

Certain internal objects may only be queried by superusers or by users belonging to a particular builtin role, which superusers may grant. These include the following:

Name Description
mz_monitor Grants access to objects that reveal actions taken by other users, in particular, SQL statements they have issued. Includes mz_recent_activity_log and mz_notices.
mz_monitor_redacted Grants access to objects that reveal less sensitive information about actions taken by other users, for example, SQL statements they have issued with constant values redacted. Includes mz_recent_activity_log_redacted, mz_notices_redacted, and mz_statement_lifecycle_history.
Back to top ↑