Permissions

All actions that can be performed in ByteHouse are defined with corresponding permissions. For example: viewing account resource usage, creating new users, querying data from a table, or loading large datasets into ByteHouse.
Permissions related to specific resources, such as creating tables (related to databases), inserting new data (related to tables), and running virtual warehouses (related to warehouses), are bound to specific resource instances or objects.
Other permissions, such as creating databases (note: databases are account-level resources), viewing billing status, or creating new service users, are not bound to any specific object.

Roles

Permission control in ByteHouse is performed at the role level. Each ByteHouse user can be assigned one or more roles.

System default roles

• Account administrator (AccountAdmin): The default role for the primary account; it is the root role of the ByteHouse account and is not granted to other sub-users.
• System administrator (SystemAdmin): The direct sub-role of the account administrator. Users with this role will have permissions for all platform resources, such as databases, tables, virtual warehouses, online worksheets, and more. The permission scope is equivalent to the ByteHouseFullAccess IAM policy. If this role is granted to a sub-user, the sub-user will have all operational permissions in ByteHouse (excluding unsubscription).

Custom roles

Custom roles are created within ByteHouse cloud data warehouse and can be granted the necessary permissions for ByteHouse cloud data warehouse resources and data.

Create database

After turning on the switch, the role will have permissions to create databases and browse all databases.

Create external catalog

After turning on the switch, the role will have permissions to create, delete, and view external catalogs.

Data loading management

After enabling the switch, the role will have all functional permissions of the data import module, including creating, editing, and deleting import tasks, as well as creating, editing, and deleting data sources.

Knowledge base management

After enabling the switch, the role will have permissions to create, view, and manage knowledge bases.

Compute group management

By default, custom roles have VIEW permission for compute groups. You can configure whether the role has USE or ALL permissions for compute groups as needed, and you can also set whether the scope of compute groups controlled by the role is a specific compute group or all compute groups.

• VIEW: Allows viewing compute groups and query history
• USE: Allows using compute groups for queries and restoring compute groups when "Auto Recovery" is enabled
• ALL: Grants all permissions for compute groups

Global audit logs

After enabling the switch, the role will have permission to view global audit logs, including SQL history, running queries, permission audits, compute group audits, and user activities. Sub-users with this role can directly view all sub-users' global audit log information.

Global

Select the permission points to grant. After granting global permissions, all data objects in the environment will be granted the selected permission points.

Database

Select the databases to authorize and grant database permission points.

Data table

Select the databases and their data tables to authorize, and grant data table permission points.

View

Select the databases and their views to authorize, and grant view permission points.

Materialized view

Select the databases and their materialized views to authorize, and grant materialized view permission points.

Dictionary

Select the databases and their dictionaries to authorize, and grant dictionary permission points.

UDF

Select the UDF permission points to grant.

External Catalog

Select the external Catalogs to authorize and grant the corresponding permission points.