[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-25 (世界標準時間)。"],[[["\u003cp\u003eAlloyDB for PostgreSQL utilizes roles, users, and groups, similar to standard PostgreSQL, to manage database access and privileges.\u003c/p\u003e\n"],["\u003cp\u003eUsers can authenticate with AlloyDB database clusters using either standard PostgreSQL password-based methods or Identity and Access Management (IAM) authentication.\u003c/p\u003e\n"],["\u003cp\u003eAlloyDB provides several predefined roles, including \u003ccode\u003ealloydbsuperuser\u003c/code\u003e, \u003ccode\u003epostgres\u003c/code\u003e, \u003ccode\u003ealloydbimportexport\u003c/code\u003e, \u003ccode\u003ealloydbagent\u003c/code\u003e, \u003ccode\u003ealloydbreplica\u003c/code\u003e, and \u003ccode\u003ealloydbiamuser\u003c/code\u003e, each with specific privileges.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ealloydbsuperuser\u003c/code\u003e role in AlloyDB grants superuser privileges for tasks like creating extensions and managing replication, and it is used in place of the standard PostgreSQL \u003ccode\u003esuperuser\u003c/code\u003e role, which is unavailable in AlloyDB.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ealloydbiamuser\u003c/code\u003e group role enables database users to authenticate using IAM, offering enhanced security and centralized access control.\u003c/p\u003e\n"]]],[],null,["This page provides an overview about how to manage database users in\nAlloyDB for PostgreSQL, and enable Identity and Access Management (IAM) authentication for those\ndatabase users.\n\nHow database user management works\n\nAlloyDB shares the same concepts of roles, users, and groups as\n[PostgreSQL](https://www.postgresql.org/docs/16/user-manag.html). For a\nbrief explanation, see the following descriptions:\n\n- **Role:** the top-level designation that describes both database users and\n groups of database users across a cluster. Roles provide, and restrict,\n access to database objects, such as tables and functions.\n\n- **User:** the role that's given the\n [`LOGIN`](https://www.postgresql.org/docs/16/role-attributes.html#ROLE-ATTRIBUTES)\n attribute. Users can authenticate and sign into AlloyDB\n database clusters.\n\n- **Group:** the role that's granted to one or more users. The purpose of\n groups is to control the privileges that many users have as a whole.\n\nHow database authentication works\n\nTo authenticate and sign into your AlloyDB database clusters, you\nhave two options:\n\n- [Built-in PostgreSQL password-based authentication](https://www.postgresql.org/docs/16/auth-password.html#AUTH-PASSWORD): to verify user identity, AlloyDB compares the provided credentials against stored, hashed passwords. The supported methods include `md5`, `scram-sha-256`, and `password`.\n- [IAM authentication](/alloydb/docs/database-users/manage-iam-auth): lets database users authenticate using IAM. This provides enhanced security and centralizes access control across other Google Cloud services.\n\nPredefined roles\n\nPostgreSQL provides [predefined roles](https://www.postgresql.org/docs/16/predefined-roles.html#PREDEFINED-ROLES)\nwith various privileges. In addition to these predefined roles,\nAlloyDB provides several more predefined user and group roles.\n\nThe following tables lists the roles, and role privileges, that\nAlloyDB provides:\n\n| Role name | Privileges |\n|-----------------------------------------------|----------------------------------------------------|\n| [`alloydbsuperuser`](#alloydbsuperuser) | `CREATEROLE`, `CREATEDB`, and `LOGIN`. |\n| [`postgres`](#postgres-user) | `CREATEROLE`, `CREATEDB`, and `LOGIN`. |\n| [`alloydbimportexport`](#alloydbimportexport) | `CREATEROLE` and `CREATEDB`. |\n| [`alloydbagent`](#alloydbagent) | `CREATEROLE` and `CREATEDB`. |\n| [`alloydbreplica`](#alloydbreplica) | `REPLICATION` |\n| [`alloydbiamuser`](#alloydbiamuser) | By default, this role doesn't have any privileges. |\n\nThe following subsections explain the uses of these roles.\n\n`alloydbsuperuser` group role\n\n`alloydbsuperuser` lets you set up your database system and perform other\nsuperuser tasks. This role has the following privileges:\n\n- Create extensions that require superuser privileges\n- Create event triggers\n- Create replication users\n- Create replication publications and subscriptions\n\nAs a managed service, AlloyDB doesn't let you grant users the\nPostgreSQL `superuser` role. Instead, you can give any database user\nAlloyDB superuser privileges if you grant them the\n`alloydbsuperuser` role.\n\n`postgres` user role\n\nThe `postgres` user role is part of `alloydbsuperuser`. When you create an\nAlloyDB cluster, you assign a password to `postgres`. Then, you\nsign in to your system using `postgres` to perform tasks such as to create\ndatabases or additional roles.\n\n`alloydbimportexport` user role\n\nWhen you create an AlloyDB cluster, AlloyDB\ncreates `alloydbimportexport` with the minimal set of privileges it requires for\nimport and export operations.\n\nYou have the option to create your own users to perform these operations. If you\ndon't create a custom `alloydbimportexport` user, the system uses the default\n`alloydbimportexport` user for import and export operations.\n\n`alloydbimportexport` is a system user. This means that you can't directly\nuse `alloydbimportexport` user to sign in or perform other operations in your\nPostgreSQL databases.\n\n`alloydbagent` user role\n\nThe `alloydbagent` role is an internal AlloyDB system role. The\nAlloyDB service manages the role and you can't manually grant it\nto database accounts. This management ensures that the database and its features\nfunction correctly.\n\n`alloydbreplica` user role\n\nThe `alloydbreplica` role is an internal AlloyDB system role. The\nAlloyDB service manages the role and you can't manually grant it\nto database accounts. This management ensures that the database and its features\nfunction correctly.\n\n`alloydbiamuser` group role\n\nDatabase users within the `alloydbiamuser` group authenticate with an\nAlloyDB instance by using IAM,\ninstead of using built-in PostgreSQL\n[password-based authentication](https://www.postgresql.org/docs/16/auth-password.html#AUTH-PASSWORD).\n\nAlloyDB doesn't let you grant `alloydbiamuser` to users\nusing the `GRANT` PostgreSQL command or similar methods. Instead, you can use\nAlloyDB administrative tools to create and manage\nIAM-based database users. For more information, see\n[Manage IAM authentication](/alloydb/docs/database-users/manage-iam-auth).\n\nWhat's next\n\n- Learn how to\n [manage PostgreSQL roles, users, and groups](/alloydb/docs/database-users/manage-roles)\n for AlloyDB using built-in authentication.\n\n- Learn how to\n [manage IAM authentication](/alloydb/docs/database-users/manage-iam-auth)."]]
