Permissions Matrix

ALL PRIVILEGES

Cluster

All permissions.

USAGE

Cluster

Connect, show variables.

SELECT

Cluster, Database, Table

Select rows.

INSERT

Cluster, Database, Table

Insert rows.

UPDATE

Cluster, Database, Table

Update cells of existing rows.

DELETE

Cluster, Database, Table

Delete rows.

CREATE

Cluster, Database, Table

Create tables.

DROP

Cluster, Database, Table

Drop tables.

RELOAD

Cluster, Database

Load backups into database.

FILE WRITE

Cluster

File write access.

PROCESS

Cluster

View and kill queries.

Required to query the MV_TRACE_EVENTS information schema.

Required to query MV_TRACE_EVENTS_STATUS (if user does not have ALTER TRACE)

FILE READ

Cluster

File read access.

WITH GRANT OPTION

<tied to permissions>

INDEX

Cluster, Database, Table

Create and drop indexes.

ALTER

Cluster, Database, Table

Alter tables (including indexes).

SHOW METADATA

Cluster

Show all metadata.

SUPER

Cluster

Set global variables, modify resource pool settings.

SYSTEM_VARIABLES_ADMIN

Cluster

Allow users to set certain engine variables. These engine variables can be found by running the SHOW VARIABLES EXTENDED command and confirming the value is "Yes" in the In_Allow_List column.

Allow users to change the value of the privilege_transfer_mode engine variable. Setting this variable to per_privilege allows users to transfer specific privileges to other users via the TRANSFERABLE argument.

CREATE TEMPORARY TABLES

Cluster, Database

Create temporary tables.

LOCK TABLES

Cluster, Database

Lock tables (read and write).

REPLICATION

Cluster, Database

Read data for replication. This permission cannot be granted directly -- use ALL PRIVILEGES to grant it.

CREATE VIEW

Cluster, Database

Create views.

ALTER VIEW

Cluster, Database, View

Alter views.

DROP VIEW

Cluster, Database, Table

Drop views.

SHOW VIEW

Cluster, Database, View

Show VIEW definitions.

CLUSTER

Cluster

Cluster administration, including replication, partition movement, and topology. Includes all permissions in SHOW METADATA.

BACKUP

Cluster, Database

Take backups and snapshots.

CREATE USER

Cluster

Create and drop users (no grants).

ALTER USER

Cluster

Alter user profiles with ALTER USER or SET PASSWORD commands.

GRANT

Cluster, Database

Grant / revoke permissions, manage roles & groups. Distinct from WITH GRANT OPTION.

DROP DATABASE

Cluster, Database

Drop databases.

CREATE DATABASE

Cluster, Database

Create databases.

CREATE ROUTINE

Cluster, Database, Function

Create extensibility functions or procedures.

ALTER ROUTINE

Cluster, Database, Function

Replace or delete extensibility functions or procedures.

SHOW ROUTINE

Database

See stored procedure bodies in Information Schema/show commands.

EXECUTE

Cluster, Database, Function

Execute extensibility functions or procedures.

CREATE PIPELINE

Cluster, Database, Table

Create pipelines.

DROP PIPELINE

Cluster, Database, Table

Drop pipelines.

START PIPELINE

Cluster, Database, Table

Start pipelines.

ALTER PIPELINE

Cluster, Database, Table

Alter pipelines.

SHOW PIPELINE

Cluster, Database, Table

Show pipelines.

CREATE LINK

Cluster, Database

Create link.

DROP LINK

Cluster, Database

Drop link.

SHOW LINK

Cluster, Database

Show links. This permission applies for commands such as BACKUP, RESTORE, CREATE PIPELINE, and SELECT that use connection links.

OUTBOUND

Cluster, Database

The OUTBOUND privilege is required to create an outbound connection between SingleStore and an a 3rd party object store.

CREATE POOL

Cluster

Create resource pool.

DROP POOL

Cluster

Drop resource pool.

ALTER TRACE

Cluster

Required to create or drop trace events

Required to query MV_TRACE_EVENTS_STATUS (if user does not have PROCESS)

ADD AGGREGATOR

CLUSTER

ADD LEAF

CLUSTER and WITH GRANT OPTION

AGGREGATOR SET AS MASTER

CLUSTER

AGGREGATOR SYNC AUTO_INCREMENT

CREATE, INSERT, UPDATE, DELETE, INDEX, DROP, or ALTER

Applies on a table-by-table basis.

ALTER NODE

CLUSTER

ALTER RESOURCE POOL

CREATE POOL or DROP POOL

ALTER TABLE ADD COLUMNS

ALTER

ALTER TABLE ADD INDEX

INDEX

ALTER

ALTER TABLE DROP COLUMNS

ALTER

ALTER TABLE DROP INDEX

INDEX

ALTER

ALTER VIEW

ALTER VIEW

ALTER PIPELINE

ALTER PIPELINE

Requires SUPER if using a transform and the URI in the WITH TRANSFORM clause does not have the prefix memsql://.

ALTER USER

GRANT or ALTER USER

ANALYZE TABLE

SELECT and (INSERT or ALTER)

ATTACH DATABASE

CREATE DATABASE

if Unlimited Storage. Otherwise CREATE DATABASE.

ATTACH LEAF

CLUSTER

ATTACH LEAF ALL

CLUSTER

ATTACH PARTITION

CLUSTER

BACKUP

BACKUP

BOOTSTRAP AGGREGATOR

CLUSTER

CALL

EXECUTE

CONTINUE REPLICATING

CREATE DATABASE

COPY PARTITION

CLUSTER

CREATE DATABASE

CREATE DATABASE

CREATE EVENT TRACE

ALTER TRACE

CREATE EXTENSION

CREATE EXTENSION, SHOW EXTENSION, ALTER EXTENSION, DROP EXTENSION

CREATE FUNCTION

CREATE ROUTINE

CREATE LINK

CREATE LINK

CREATE MILESTONE

CREATE TABLE

CREATE OR REPLACE FUNCTION

CREATE ROUTINE is required if the function currently does not exist, ALTER ROUTINE is required if the function currently exists.

CREATE GROUP

GRANT

CREATE INDEX

INDEX

ALTER

CREATE PARTITION

CLUSTER

CREATE PIPELINE

CREATE PIPELINE

Requires EXECUTE if using INTO PROCEDURE. Requires SUPER if using a transform and the URI in the WITH TRANSFORM clause does not have the prefix memsql://.

CREATE OR REPLACE PIPELINE

CREATE PIPELINE and ALTER PIPELINE

Requires EXECUTE if using INTO PROCEDURE. Requires SUPER if using a transform and the URI in the WITH TRANSFORM clause does not have the prefix memsql://.

CREATE PROCEDURE

CREATE ROUTINE

CREATE OR REPLACE PROCEDURE

CREATE ROUTINE is required if the procedure currently does not exist, ALTER ROUTINE is required if the procedure currently exists.

CREATE RESOURCE POOL

CREATE POOL

CREATE ROLE

GRANT

CREATE TABLE

CREATE

CREATE TEMPORARY TABLE

CREATE TEMPORARY TABLES

CREATE USER

CREATE USER

CREATE VIEW

CREATE VIEW

DELETE

DELETE

DESCRIBE TABLE

SHOW METADATA

One or more of the show and create table permissions.

DETACH DATABASE

DROP DATABASE

DETACH LEAF

CLUSTER

DETACH PARTITION

CLUSTER

DROP ... FROM PLANCACHE

PROCESS

DROP DATABASE

DROP DATABASE

DROP EVENT TRACE

ALTER TRACE

DROP EXTENSION

DROP EXTENSION

DROP FUNCTION

ALTER ROUTINE

DROP GROUP

GRANT

DROP INDEX

INDEX

ALTER

DROP LINK

DROP LINK

DROP PARTITION

CLUSTER

DROP PIPELINE

DROP PIPELINE

DROP PROCEDURE

ALTER ROUTINE

DROP RESOURCE POOL

DROP POOL

DROP ROLE

GRANT

DROP TABLE

DROP

DROP USER

CREATE USER

DROP VIEW

DROP VIEW

ECHO

EXECUTE

EXPLAIN

<can EXECUTE q>

EXPLAIN REBALANCE

SHOW METADATA

CLUSTER

EXTRACT PIPELINE

FILE WRITE and START PIPELINE

FLUSH TABLES

CLUSTER

FULLTEXT SERVICE STOP

PROCESS

GRANT

GRANT

GRANT GROUP

GRANT

GRANT ROLE

GRANT

INSERT

INSERT

INSERT ... ON DUPLICATE KEY UPDATE

INSERT and UPDATE

INSERT SELECT

INSERT and SELECT

INSERT SELECT ... ON DUPLICATE KEY UPDATE

INSERT and SELECT and UPDATE

KILL CONNECTION

PROCESS

Any user may kill their own connections. The PROCESS permission is required to kill another user’s connection.

KILLALL CONNECTIONS

PROCESS

With the PROCESS permission, kills all connections. Otherwise, kills all connections owned by your user.

LOAD DATA

INSERT and FILE READ

LOAD DATA ... REPLACE

INSERT and FILE READ and DELETE

LOAD DATA ... LOCAL

INSERT

LOAD DATA ... LOCAL ... REPLACE

INSERT and DELETE

LOCK TABLES

SELECT and LOCK TABLES

OPTIMIZE PIPELINE

START PIPELINE

OPTIMIZE TABLE

INSERT

PAUSE REPLICATING

CREATE DATABASE

PROFILE PIPELINE

START PIPELINE

PROFILE PIPELINE JSON

START PIPELINE

PROMOTE PARTITION

CLUSTER

PROMOTE AGGREGATOR

CLUSTER

REBALANCE PARTITIONS

CLUSTER

REMOVE AGGREGATOR

CLUSTER

REMOVE LEAF

CLUSTER

REOPTIMIZE

<can EXECUTE q>

REPAIR DATABASE

CREATE

REPLACE

INSERT and DELETE

REPLACE SELECT

INSERT and SELECT and DELETE

REPLICATE DATABASE

CREATE DATABASE

RESTORE DATABASE

RELOAD

RESTORE REDUNDANCY

CLUSTER

REVOKE

GRANT

SELECT

SELECT

SELECT * FROM information_schema.LOAD_DATA_ERRORS or any pipeline information_schema table

INSERT and SHOW METADATA

For more information, see the Information Schema Introduction.

SELECT * FROM information_schema.MV_QUERIES or any workload profiling information_schema table

PROCESS and SHOW METADATA

For more information, see the Information Schema Introduction.

SELECT * FROM information_schema.<TABLE_NAME>

SHOW METADATA

For more information, see the Information Schema Introduction.

SELECT * FROM information_schema.parameters

SHOW ROUTINE

Allows the user to see the body of the Procedure/Routine without the permissions required to be able to edit it.

SELECT * FROM information_schema.routines

SHOW ROUTINE

SELECT (from TVF)

EXECUTE

SELECT GLOBAL

USAGE

SELECT INTO OBJECTSTORE (S3/KAFKA)

SELECT

SELECT INTO OUTFILE/FS

SELECT and FILE WRITE

SET GLOBAL

SUPER

SET PASSWORD

SUPER or ALTER USER

SHOW AGGREGATES

CREATE ROUTINE or ALTER ROUTINE or EXECUTE

SHOW AGGREGATES EXTENDED

CREATE ROUTINE or ALTER ROUTINE or EXECUTE

SHOW AGGREGATORS

SHOW METADATA

CLUSTER

SHOW CLUSTER STATUS

SHOW METADATA

CLUSTER

SHOW COLUMNS

SHOW METADATA

One or more of the show and create table permissions.

SHOW MERGE STATUS

SHOW METADATA

CLUSTER

SHOW CREATE AGGREGATE

CREATE ROUTINE or ALTER ROUTINE or EXECUTE

SHOW CREATE FUNCTION / SHOW CREATE PROCEDURE

CREATE ROUTINESHOW ROUTINEALTER ROUTINE or EXECUTE.

If the user only has EXECUTE permissions, then only the function header will be shown and the function body will be hidden.

The SHOW ROUTINE permission allows a user to view but not edit the bodies of procedures.

SHOW CREATE PIPELINE

SHOW METADATA

SHOW PIPELINE or CREATE PIPELINE or ALTER PIPELINE or DROP PIPELINE or START PIPELINE

SHOW CREATE TABLE

SHOW METADATA

One or more of the show and create table permissions.

SHOW CREATE VIEW

SHOW METADATA

SHOW VIEW

SHOW DATABASE STATUS

SHOW METADATA

CLUSTER or REPLICATION

SHOW DATABASES

SHOW METADATA

One or more of the database and table permissions or CLUSTER or SHOW METADATA or GRANT.

SHOW DATABASES EXTENDED

SHOW METADATA

CLUSTER

SHOW ERRORS

USAGE

SHOW FUNCTIONS

CREATE ROUTINE or ALTER ROUTINE or EXECUTE

SHOW GC STATUS

SHOW METADATA

CLUSTER

SHOW GLOBAL STATUS

USAGE

SHOW GLOBAL VARIABLES

USAGE

SHOW GRANTS

GRANT

GRANT if showing grants for groups or roles. GRANT or SHOW METADATA if showing grants for users.

SHOW INDEXES

SHOW METADATA

SELECT or INDEX

SHOW LEAF STATUS

SHOW METADATA

CLUSTER

SHOW LEAVES

SHOW METADATA

CLUSTER

SHOW LINKS

SHOW LINK

The SHOW LINK permission applies for commands such as BACKUP, RESTORE, CREATE PIPELINE, and SELECT that use connection links.

SHOW PARTITIONS

SHOW METADATA

CLUSTER

SHOW PLANCACHE

PROCESS

With the PROCESS permission, shows all plans. Otherwise, shows all plans for queries you have permission to run.

SHOW PRIVILEGES

USAGE

SHOW PROCESSLIST

PROCESS

With the PROCESS permission, shows all processes. Otherwise, shows all processes owned by your user.

SHOW REBALANCE STATUS

SHOW METADATA

CLUSTER

SHOW REPLICATION STATUS

SHOW METADATA

CLUSTER

SHOW RESOURCE POOL

SUPER

CREATE POOL is required unless the user has access to the pool.

SHOW SESSION STATUS

USAGE

SHOW SESSION VARIABLES

USAGE

SHOW STATUS

USAGE

SHOW STATUS EXTENDED

USAGE

SHOW TABLES

SHOW METADATA

SELECT or INSERT or UPDATE or DELETE or CREATE or DROP or INDEX or ALTER or CREATE VIEW or SHOW VIEW or GRANT.

SHOW VARIABLES

USAGE

SHOW WARNINGS

USAGE

SNAPSHOT DATABASE

BACKUP

START PIPELINE

START PIPELINE

STOP PIPELINE

START PIPELINE

STOP REPLICATING

CREATE DATABASE

TEST PIPELINE

START PIPELINE

TRIGGER GC

SUPER

TRUNCATE

DROP, DELETE

DELETE added as of version 7.6.10.

UNION ALL

USAGE

UNLOCK TABLES

USAGE

UPDATE

UPDATE

USE

SHOW METADATA

One or more of the database and table permissions or SHOW METADATA or GRANT.