Home  /  Operating Materialize  /  Access control

Role-based access control (RBAC)

This page introduces role-based access management (RBAC) in Materialize. RBAC allows you to apply granular privileges to your Materialize objects and clusters. Organizations using RBAC can manage user roles and privileges to ensure there is not unauthorized or improper access to sensitive objects.

In Materialize, RBAC allows organization administrators to:

  • Determine which users have read or write privileges for specific objects

  • Control how users interact with clusters by giving them different levels of access to resources

  • Prevent accidental operations from unauthorized users

  • Isolate access to user-facing data from internal organization data

Materialize object access is also dependent on cluster privileges. Roles that need access to an object that use compute resources must also have the same level of access to the cluster. Materialize objects that use compute resources are:

  • Replicas
  • Sources
  • Sinks
  • Indexes
  • Materialized views

The next sections go over the concepts of authorization and authentication and the objects within Materialize.

RBAC structure

RBAC in practice is a group of roles with assigned privileges. You can assign specific users to roles or assign privileges to users to inherit from other roles.

Roles

A role is a collection of privileges you can apply to users. Roles make it easier to assign or revoke privileges on Materialize objects. You can group users into specified roles with different levels of privileges and adjust those privileges to ensure they have the correct level of access to objects.

Role attributes

Role attributes are actions available to any role you create. Attributes are independent of any other object in Materialize and apply to the entire organization. You can edit these actions when you create the role:

Name Description
INHERIT Read-only. Can inherit privileges of other roles.

PostgreSQL uses role attributes to determine if a role is allowed to execute certain statements. In Materialize these have all been replaced by system privileges.

Privileges

Privileges are the actions or operations a role is allowed to perform on a specific object. After you create a role, you can grant it the following object-specific privileges in Materialize:

Privilege Description psql
SELECT Allows selecting rows from an object. r
INSERT Allows inserting into an object. a
UPDATE Allows updating an object (requires SELECT). w
DELETE Allows deleting from an object (requires SELECT). d
CREATE Allows creating a new object within another object. C
USAGE Allows using an object or looking up members of an object. U
CREATEROLE Allows creating, altering, deleting roles and the ability to grant and revoke role membership. R
CREATEDB Allows creating databases. B
CREATECLUSTER Allows creating clusters. N
CREATENETWORKPOLICY Allows creating network policies. P

Note that the system catalog uses the abbreviation of the privilege name.

Objects in Materialize have different levels of privileges available to them. Materialize supports the following object type privileges:

Object Type Privileges
SYSTEM CREATEROLE, CREATEDB, CREATECLUSTER, CREATENETWORKPOLICY
DATABASE USAGE, CREATE
SCHEMA USAGE, CREATE
TABLE INSERT, SELECT, UPDATE, DELETE
VIEW SELECT
MATERIALIZED VIEW SELECT
TYPE USAGE
SOURCE SELECT
CONNECTION USAGE
SECRET USAGE
CLUSTER USAGE, CREATE

Inheritance

Inheritance in RBAC allows you to create roles that inherit privileges from other roles. Inheritance only applies to role privileges; role attributes and parameters are not inherited. Inheriting privileges allows you to minimize the number of roles you have to manage.

Back to top ↑