alloydbsuperuser를 사용하면 데이터베이스 시스템을 설정하고 기타 슈퍼 사용자 작업을 실행할 수 있습니다. 이 역할에는 다음 권한이 있습니다.
수퍼유저 권한이 필요한 확장 프로그램 만들기
이벤트 트리거 만들기
복제 사용자 만들기
복제 게시 및 구독 만들기
관리형 서비스인 AlloyDB에서는 사용자에게 PostgreSQL superuser 역할을 부여할 수 없습니다. 대신 alloydbsuperuser 역할을 부여하여 데이터베이스 사용자에게 AlloyDB 수퍼유저 권한을 부여할 수 있습니다.
postgres 사용자 역할
postgres 사용자 역할은 alloydbsuperuser의 일부입니다. AlloyDB 클러스터를 만들 때 postgres에 비밀번호를 할당합니다. 그런 다음 postgres를 사용하여 시스템에 로그인하여 데이터베이스 또는 추가 역할을 만드는 등의 작업을 실행합니다.
alloydbimportexport 사용자 역할
AlloyDB 클러스터를 만들면 AlloyDB에서 가져오기 및 내보내기 작업에 필요한 최소 권한 집합으로 alloydbimportexport를 만듭니다.
이러한 작업을 수행할 사용자를 자체적으로 만들 수 있습니다. 맞춤 alloydbimportexport 사용자를 만들지 않으면 시스템에서 가져오기 및 내보내기 작업에 기본 alloydbimportexport 사용자를 사용합니다.
alloydbimportexport은 시스템 사용자입니다. 즉, alloydbimportexport 사용자를 직접 사용하여 PostgreSQL 데이터베이스에 로그인하거나 다른 작업을 실행할 수 없습니다.
alloydbagent 사용자 역할
alloydbagent 역할은 내부 AlloyDB 시스템 역할입니다. AlloyDB 서비스에서 관리하며 데이터베이스 계정에 수동으로 부여할 수 없습니다. 따라서 데이터베이스와 기능이 올바르게 작동합니다.
alloydbreplica 사용자 역할
alloydbreplica 역할은 내부 AlloyDB 시스템 역할입니다. AlloyDB 서비스에서 관리하며 데이터베이스 계정에 수동으로 부여할 수 없습니다. 따라서 데이터베이스와 기능이 올바르게 작동합니다.
alloydbiamuser 그룹 역할
alloydbiamuser 그룹 내 데이터베이스 사용자는 표준 PostgreSQL 비밀번호 기반 인증을 사용하는 대신 IAM을 사용하여 AlloyDB 인스턴스를 인증합니다.
AlloyDB에서는 GRANT PostgreSQL 명령어 또는 유사한 방법을 사용하여 사용자에게 alloydbiamuser를 부여할 수 없습니다. 대신 AlloyDB 관리 도구를 사용하여 IAM 기반 데이터베이스 사용자를 만들고 관리할 수 있습니다. 자세한 내용은 IAM 인증 관리를 참고하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-25(UTC)"],[[["\u003cp\u003eAlloyDB for PostgreSQL utilizes roles, users, and groups, similar to standard PostgreSQL, to manage database access and privileges.\u003c/p\u003e\n"],["\u003cp\u003eUsers can authenticate with AlloyDB database clusters using either standard PostgreSQL password-based methods or Identity and Access Management (IAM) authentication.\u003c/p\u003e\n"],["\u003cp\u003eAlloyDB provides several predefined roles, including \u003ccode\u003ealloydbsuperuser\u003c/code\u003e, \u003ccode\u003epostgres\u003c/code\u003e, \u003ccode\u003ealloydbimportexport\u003c/code\u003e, \u003ccode\u003ealloydbagent\u003c/code\u003e, \u003ccode\u003ealloydbreplica\u003c/code\u003e, and \u003ccode\u003ealloydbiamuser\u003c/code\u003e, each with specific privileges.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ealloydbsuperuser\u003c/code\u003e role in AlloyDB grants superuser privileges for tasks like creating extensions and managing replication, and it is used in place of the standard PostgreSQL \u003ccode\u003esuperuser\u003c/code\u003e role, which is unavailable in AlloyDB.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ealloydbiamuser\u003c/code\u003e group role enables database users to authenticate using IAM, offering enhanced security and centralized access control.\u003c/p\u003e\n"]]],[],null,["This page provides an overview about how to manage database users in\nAlloyDB for PostgreSQL, and enable Identity and Access Management (IAM) authentication for those\ndatabase users.\n\nHow database user management works\n\nAlloyDB shares the same concepts of roles, users, and groups as\n[PostgreSQL](https://www.postgresql.org/docs/16/user-manag.html). For a\nbrief explanation, see the following descriptions:\n\n- **Role:** the top-level designation that describes both database users and\n groups of database users across a cluster. Roles provide, and restrict,\n access to database objects, such as tables and functions.\n\n- **User:** the role that's given the\n [`LOGIN`](https://www.postgresql.org/docs/16/role-attributes.html#ROLE-ATTRIBUTES)\n attribute. Users can authenticate and sign into AlloyDB\n database clusters.\n\n- **Group:** the role that's granted to one or more users. The purpose of\n groups is to control the privileges that many users have as a whole.\n\nHow database authentication works\n\nTo authenticate and sign into your AlloyDB database clusters, you\nhave two options:\n\n- [Built-in PostgreSQL password-based authentication](https://www.postgresql.org/docs/16/auth-password.html#AUTH-PASSWORD): to verify user identity, AlloyDB compares the provided credentials against stored, hashed passwords. The supported methods include `md5`, `scram-sha-256`, and `password`.\n- [IAM authentication](/alloydb/docs/database-users/manage-iam-auth): lets database users authenticate using IAM. This provides enhanced security and centralizes access control across other Google Cloud services.\n\nPredefined roles\n\nPostgreSQL provides [predefined roles](https://www.postgresql.org/docs/16/predefined-roles.html#PREDEFINED-ROLES)\nwith various privileges. In addition to these predefined roles,\nAlloyDB provides several more predefined user and group roles.\n\nThe following tables lists the roles, and role privileges, that\nAlloyDB provides:\n\n| Role name | Privileges |\n|-----------------------------------------------|----------------------------------------------------|\n| [`alloydbsuperuser`](#alloydbsuperuser) | `CREATEROLE`, `CREATEDB`, and `LOGIN`. |\n| [`postgres`](#postgres-user) | `CREATEROLE`, `CREATEDB`, and `LOGIN`. |\n| [`alloydbimportexport`](#alloydbimportexport) | `CREATEROLE` and `CREATEDB`. |\n| [`alloydbagent`](#alloydbagent) | `CREATEROLE` and `CREATEDB`. |\n| [`alloydbreplica`](#alloydbreplica) | `REPLICATION` |\n| [`alloydbiamuser`](#alloydbiamuser) | By default, this role doesn't have any privileges. |\n\nThe following subsections explain the uses of these roles.\n\n`alloydbsuperuser` group role\n\n`alloydbsuperuser` lets you set up your database system and perform other\nsuperuser tasks. This role has the following privileges:\n\n- Create extensions that require superuser privileges\n- Create event triggers\n- Create replication users\n- Create replication publications and subscriptions\n\nAs a managed service, AlloyDB doesn't let you grant users the\nPostgreSQL `superuser` role. Instead, you can give any database user\nAlloyDB superuser privileges if you grant them the\n`alloydbsuperuser` role.\n\n`postgres` user role\n\nThe `postgres` user role is part of `alloydbsuperuser`. When you create an\nAlloyDB cluster, you assign a password to `postgres`. Then, you\nsign in to your system using `postgres` to perform tasks such as to create\ndatabases or additional roles.\n\n`alloydbimportexport` user role\n\nWhen you create an AlloyDB cluster, AlloyDB\ncreates `alloydbimportexport` with the minimal set of privileges it requires for\nimport and export operations.\n\nYou have the option to create your own users to perform these operations. If you\ndon't create a custom `alloydbimportexport` user, the system uses the default\n`alloydbimportexport` user for import and export operations.\n\n`alloydbimportexport` is a system user. This means that you can't directly\nuse `alloydbimportexport` user to sign in or perform other operations in your\nPostgreSQL databases.\n\n`alloydbagent` user role\n\nThe `alloydbagent` role is an internal AlloyDB system role. The\nAlloyDB service manages the role and you can't manually grant it\nto database accounts. This management ensures that the database and its features\nfunction correctly.\n\n`alloydbreplica` user role\n\nThe `alloydbreplica` role is an internal AlloyDB system role. The\nAlloyDB service manages the role and you can't manually grant it\nto database accounts. This management ensures that the database and its features\nfunction correctly.\n\n`alloydbiamuser` group role\n\nDatabase users within the `alloydbiamuser` group authenticate with an\nAlloyDB instance by using IAM,\ninstead of using built-in PostgreSQL\n[password-based authentication](https://www.postgresql.org/docs/16/auth-password.html#AUTH-PASSWORD).\n\nAlloyDB doesn't let you grant `alloydbiamuser` to users\nusing the `GRANT` PostgreSQL command or similar methods. Instead, you can use\nAlloyDB administrative tools to create and manage\nIAM-based database users. For more information, see\n[Manage IAM authentication](/alloydb/docs/database-users/manage-iam-auth).\n\nWhat's next\n\n- Learn how to\n [manage PostgreSQL roles, users, and groups](/alloydb/docs/database-users/manage-roles)\n for AlloyDB using built-in authentication.\n\n- Learn how to\n [manage IAM authentication](/alloydb/docs/database-users/manage-iam-auth)."]]
