Skip to main content

Warehouse Users and Roles

You can use warehouse users and roles to control which people, applications, BI tools, and data pipelines can connect to a warehouse and what they can do after connecting. Create warehouse users, assign roles, and grant only the privileges each workload needs. This lets you separate access by workload, apply least-privilege access, and manage credentials independently from console access.

Warehouse users and roles are separate from the organization members and organization roles. For more information about organization-level access control, see Members.

Note:

  • You need the ADMIN privilege or a global-level GRANT privilege to add or modify users and roles.
  • You need the ADMIN or GRANT privilege at the corresponding scope to grant or revoke privileges.

Manage warehouse users​

A warehouse user is a SQL identity in the form 'username'@'host'. The username and host together identify a warehouse user.

Built-in warehouse users​

Each warehouse includes two built-in users:

UserDefault roleManagement behavior
admin@'%'adminYou can view its privileges and change its password, but you cannot change its default role or privileges.
root@'%'operatorYou can view its privileges, but you cannot change its password, roles, or privileges from this page.

You cannot delete or rename these built-in users.

Create a warehouse user​

To create a warehouse user, follow these steps:

  1. Log in to the VeloDB Cloud console.

  2. In the upper-left corner, click the warehouse for which you want to manage users and roles.

  3. In the left navigation pane, in the More section, click User and Roles.

  4. Click the Users tab.

  5. Click Add User. Complete the following fields:

    • Username (required): enter the warehouse username.
    • Host (optional): enter the source host from which the user can connect. The value is % by default. Host matching depends on the network path that the client uses. See Host field and connection source.
    • Password (required): enter the password used to authenticate the user.
    • Belongs to role (optional): assign one or more existing warehouse roles to the user.
    • Comment (optional): add a description of the user or its purpose.

  6. Click Confirm.

  7. After creating the user, click the user name to grant privileges. You can grant privileges on global, data, cluster, and workload group scopes. See Manage privileges for a warehouse user or role for details.

Edit a warehouse user​

To edit a warehouse user, follow these steps:

  1. Log in to the VeloDB Cloud console.
  2. In the upper-left corner, click the warehouse for which you want to manage users and roles.
  3. In the left navigation pane, in the More section, click User and Roles.
  4. Click the Users tab.
  5. Click the Actions menu for the user you want to edit, then click Edit. You can change the password, comment, and role assignments.

Note that you cannot change the username or host because those fields form the SQL identity. To use a different username or host, create a new user, grant the required roles and privileges, verify the new connection, and then delete the old user.

To change the password, follow these steps:

  1. Click the Actions menu and then click Change Password.
  2. Enter the new password.
  3. Click Confirm to save the changes.

Delete a warehouse user​

To delete a warehouse user, follow these steps:

  1. Log in to the VeloDB Cloud console.
  2. In the upper-left corner, click the warehouse for which you want to manage users and roles.
  3. In the left navigation pane, in the More section, click User and Roles.
  4. Click the Users tab.
  5. Click the Actions menu for the user you want to delete, then click Delete.
  6. Confirm the deletion.

Host field and connection source​

The Host field of a warehouse user controls which client hosts are allowed to connect. VeloDB Cloud compares the value of Host with the source IP address observed for each connection.

The source IP address observed by VeloDB Cloud depends on how the client connects to the warehouse. Public and private connections expose different source IP addresses.

Public connections (AWS or Azure public endpoint with NLB)​

For public connections, the network load balancer (NLB) preserves the client's original public IP address. VeloDB Cloud uses this IP address for Host matching.

To restrict access to a specific client, configure the client's public IP address in the Host field.

The default value % allows connections from any client IP address.

For private connections, the network load balancer does not preserve the client's original IP address. Instead, VeloDB Cloud sees the IP address of the client's VPC endpoint. As a result, configuring the originating client's IP address in the Host field does not match the observed source IP and does not restrict access.

For private connections, keep the Host field set to % (or leave it empty) and enforce IP-based access control at the network layer using:

  • VPC endpoint
  • Security groups
  • Other private-network controls in your own cloud environment

Manage warehouse roles​

You can assign multiple roles to a warehouse user. The user inherits the privileges granted to those roles.

Note:

You cannot manage user-to-role assignments from the Roles page. Assign roles when you create or modify a warehouse user.

Built-in warehouse roles​

Each warehouse includes the following protected roles:

RolePrivileges
adminThe global ADMIN privilege, which provides all Apache Doris privileges except node operations.
admin_readonlyThe global ADMIN privilege, which provides read-only access to all Apache Doris resources.
operatorThe global NODE and ADMIN privileges, which together provide all Apache Doris privileges.

You cannot delete these roles or modify their privileges. Create a new warehouse role when you need a different privilege set.

Create a warehouse role​

To create a warehouse role, follow these steps:

  1. Log in to the VeloDB Cloud console.

  2. In the upper-left corner, click the warehouse for which you want to manage users and roles.

  3. In the left navigation pane, in the More section, click User and Roles.

  4. Click the Roles tab.

  5. Click Add Role. Complete the following fields:

    • Role Name (required): enter the warehouse role name.
    • Comment (optional): add a description of the role or its purpose.

  6. Click Confirm.

  7. After creating the role, click the role name to add privileges. You can grant privileges on global, data, cluster, and workload group scopes. See Manage privileges for a warehouse user or role for details.

Delete a warehouse role​

To delete a warehouse role, follow these steps:

  1. Log in to the VeloDB Cloud console.
  2. In the upper-left corner, click the warehouse for which you want to manage users and roles.
  3. In the left navigation pane, in the More section, click User and Roles.
  4. Click the Roles tab.
  5. Click the Actions menu for the role you want to delete, then click Delete.
  6. Confirm the deletion.

Manage privileges for a warehouse user or role​

You can grant privileges to a warehouse user directly or through a warehouse role assigned to the warehouse user. The warehouse user's effective privileges are the union of the privileges granted directly to the warehouse user and those inherited from their roles.

To manage privileges for a warehouse user or role, follow these steps:

  1. Log in to the VeloDB Cloud console.
  2. In the upper-left corner, click the warehouse for which you want to manage users and roles.
  3. In the left navigation pane, in the More section, click User and Roles.
  4. Click the Users or Roles tab, then select a user or role to open its Privileges page. You can grant or revoke privileges on global, data, cluster, and workload groups. See the following table for details.

Note:

  • You must have the ADMIN privilege or the GRANT privilege at the corresponding scope. A user with the GRANT privilege must also have the privilege being granted.
  • Privileges for built-in users and roles are read-only.
ScopeWhat this scope controls
GlobalApplies to the entire warehouse. A global privilege automatically includes the matching privilege on every child object. Available global privileges include NODE, ADMIN, GRANT, SELECT, LOAD, ALTER, CREATE, and DROP.
DataApplies to data resources at the selected level, including Catalog, Database, Table, Materialized View, and View. A privilege granted on a parent object automatically includes the matching privilege on its child objects.
ClusterGrants the USAGE privilege on a cluster for connection-level access control.
Workload GroupGrants the USAGE privilege on a workload group.

See also​