CREATE SERVICE ACCOUNT reference
RBAC provides fine-grained database permissions management.
CREATE SERVICE ACCOUNT creates an identity for an application or a set of
permissions that users can assume without sharing credentials.
For full documentation of the Access Control List and Role-based Access Control, see the RBAC operations page.
Syntax
CREATE SERVICE ACCOUNT [IF NOT EXISTS] accountName [OWNED BY ownerName];
Description
CREATE SERVICE ACCOUNT adds a new service account with no permissions.
CREATE SERVICE ACCOUNT cannot set a memory limit. To cap the native memory
each of the service account's queries may allocate, use
ALTER SERVICE ACCOUNT ... SET MEMORY LIMIT
after creating it. Service accounts do not inherit group limits.
The IF NOT EXISTS and owner-validation behavior described below applies to
QuestDB Enterprise 4.2.0 and later. Before 4.2.0, IF NOT EXISTS could assign an
existing account to the statement's owner rather than leave it unchanged. See the
service account upgrade guidance
before relying on this behavior in provisioning scripts.
The chosen name must be unique across all users (including the built-in admin),
groups and service accounts. IF NOT EXISTS leaves an existing service account
unchanged: it does not assign it to the caller or to the principal named in
OWNED BY, change its credentials, or create an
ACL audit row. A name held by a user or group
still fails.
Note that new service accounts can only access the database if the necessary endpoint permissions have been granted.
When the statement creates a new account, the creating user automatically
receives the ASSUME SERVICE ACCOUNT permission with GRANT option, unless the
OWNED BY clause is present, in which case the permission is granted to the
user or group specified in the clause. To assign an existing account, use
GRANT ASSUME SERVICE ACCOUNT
explicitly.
The owner must be eligible to hold a service account. For example, a service
account cannot own another service account. Owner validation runs even with
IF NOT EXISTS, before any changes are made.
The OWNED BY clause cannot be omitted if the service account is created by an
external user, because permissions cannot be granted to them.
Examples
CREATE SERVICE ACCOUNT risk_report;
CREATE SERVICE ACCOUNT IF NOT EXISTS risk_report;
In QuestDB Enterprise 4.2.0 and later, the second statement leaves the existing account unchanged.
CREATE GROUP analysts;
CREATE SERVICE ACCOUNT dashboard OWNED BY analysts;
GRANT ASSUME SERVICE ACCOUNT risk_report TO analysts WITH GRANT OPTION;
Check the authentication methods:
SHOW SERVICE ACCOUNT risk_report;
The account has no credentials yet:
| auth_type | enabled |
|---|---|
| Password | false |
| JWK Token | false |
| REST Token | false |