Fine-grained access control system roles

This page defines the characteristics, constraints, and intended use of the three predefined system roles that fine-grained access control provides for each database. Each system role has a different set of privileges, which can't be revoked. This information applies to both GoogleSQL-dialect databases and PostgreSQL-dialect databases.

public system role

  • All fine-grained access control users have Identity and Access Management (IAM) membership in public by default.

  • All database roles inherit privileges from this role.

  • Initially, public has no privileges, but you can grant it privileges. If you grant a privilege to public, it's available to all database roles, including database roles created afterward.

spanner_info_reader system role

  • This role has the SELECT privilege on INFORMATION_SCHEMA views for GoogleSQL-dialect databases and information_schema views for PostgreSQL-dialect databases.

  • You can't grant any other privileges to spanner_info_reader.

  • Grant membership in this role to any database role that needs to have unfiltered read access to the INFORMATION_SCHEMA views (GoogleSQL-dialect databases) or the information_schema views (PostgreSQL-dialect databases).

spanner_sys_reader system role

  • This role has the SELECT privilege on SPANNER_SYS tables.

  • You can't grant any other privileges to spanner_sys_reader.

  • Grant membership in this role to any database role that must have read access to the SPANNER_SYS schema.

Restrictions on system roles

  • You can't delete a system role by using a DROP ROLE statement.

  • System roles can't be members of other database roles. That is, the following GoogleSQL statement is invalid:

    GRANT ROLE pii_access TO ROLE spanner_info_reader;

  • You can't grant membership in the public role to your database roles. For example, the following GoogleSQL statement is also invalid:

    GRANT ROLE public TO ROLE pii_access;

    However, you can grant membership in the spanner_info_reader and spanner_sys_reader roles. For example, the following are valid statements.

    GoogleSQL 

      GRANT ROLE spanner_info_reader TO ROLE pii_access;
  GRANT ROLE spanner_sys_reader TO ROLE pii_access;
  ```

    PostgreSQL 

    GRANT spanner_info_reader TO pii_access;
GRANT spanner_sys_reader TO pii_access;

What's next