Configure roles and privileges for PostgreSQL TimescaleDB users

Last update: November 03 2026Open in Markdown

You can manage user access permissions to databases in a PostgreSQL TimescaleDB cluster using roles and privileges.

A role is a predefined set of privileges for specific operations. Assigning a role grants a user all privileges included in it at once. The role applies to all databases in the cluster.

A privilege is the right to perform operations on a specific database object: a schema, table, or function. Privileges are configured using SQL commands GRANT and REVOKE.

For each user, you can:

• configure roles;
• configure privileges.

Configure user roles

Users of a PostgreSQL TimescaleDB cluster can be assigned predefined roles. You cannot create custom roles.

Each user can be assigned multiple roles simultaneously. Assigning roles does not revoke user privileges that are configured using the GRANT and REVOKE commands.

You can assign roles when creating a user as well as change the list of roles for an existing user — grant additional roles or revoke previously granted ones.

Predefined roles

The composition of predefined roles in a PostgreSQL TimescaleDB cluster cannot be changed. The superuser role is not provided.

Role	Description
dbaas_admin	Grants the user additional privileges: using subscriptions for logical replication; using privileges of the predefined role pg_monitor. For more information about predefined roles, see the instructions in the Predefined Roles PostgreSQL documentation; using extensionsthat require this role; using statistics reset functions from the extension pg_stat_statements
dbaas_replication	Grants the user additional privileges: managing logical replication slots; reading changes from a logical replication slot
pg_read_all_stats	Provides access to PostgreSQL performance statistics, including information from system monitoring and statistics views. The role is intended for diagnostics and monitoring and does not grant permissions to modify user data
pg_signal_backend	Allows sending signals to other PostgreSQL server processes, for example, terminating or canceling user sessions. The role does not allow managing superuser processes and does not grant access to user data

Change the list of roles for a user

You can change the list of roles for an existing user: grant additional roles or revoke previously granted ones.

1. In the Control panel, in the top menu, click Products and select Cloud Databases.

2. Open the Active tab.

3. Open the cluster page → Users tab.

4. From the user menu, select Configure.

5. In the Roles field, click .

6. Change the list of roles for the user by checking or unchecking the checkboxes next to the roles.

7. To save the changes, click .

Configure user privileges

A database object (schema, table, function) is created by a specific user who becomes the owner of the object and has all rights to it by default. Other users, including the database owner, can be granted privileges on the object.

Starting with PostgreSQL version 15, the CREATE privilege on the public schema is not granted by default. Patterns for working with the public schema are described in the Usage Patterns section of the Schemas documentation for PostgreSQL.

Grant privileges

You can grant users privileges on database objects using the GRANT command; for details, see the GRANT instructions in the PostgreSQL documentation.

1. Connect to the database as the object owner.

2. Grant the user the required privileges using the GRANT command.

   Example of granting read access (SELECT) to the table table to user user:

   GRANT SELECT ON table TO user;

Revoke privileges

You can revoke privileges from a user using the REVOKE command; for details, see the REVOKE instructions in the PostgreSQL documentation.

1. Connect to the database as the object owner.

2. Revoke privileges from the user using the REVOKE command.

   Example of revoking a privilege from user user on the schema schema:

   REVOKE USAGE ON SCHEMA schema FROM user;

Example of creating a schema user with read-only permissions

You can create a user with access to a cluster database, a table in the default schema, and all tables in the schema.

All new tables will automatically be created with read-only access for this user.

1. Create a user user.

2. Grant access to user user to the database.

3. Connect to the database as the object owner.

4. Create schema schema and table table:

   CREATE SCHEMA schema;
   CREATE TABLE schema.table(i int);
   INSERT INTO schema.table(i) values(1);

5. Grant privileges to user user:

   GRANT USAGE ON SCHEMA schema TO user;
   GRANT SELECT ON ALL TABLES IN SCHEMA schema TO user;
   ALTER DEFAULT PRIVILEGES IN SCHEMA schema GRANT SELECT ON TABLES TO user;