Skip to main content
This page covers the essential concepts related to access management (authorization) in CockroachDB Cloud. Procedures for managing access are covered in .

​
Overview of the CockroachDB Cloud authorization model

The CockroachDB Cloud console, found at https://cockroachlabs.cloud/, is a ‘single pane of glass’ for managing users, billing, and all functions for administering clusters in CockroachDB Cloud. When accessing the console, users must sign in to a CockroachDB Cloud organization (or create a new one). You can also execute many administrative commands using the ccloud command-line utility and the CockroachDB Cloud API:
  • ccloud allows human users to authenticate their terminal via a browser token from the CockroachDB Cloud console.
  • The CockroachDB Cloud API allows service accounts to authenticate via API keys, which are issued through the console.
  • You can . However, note that currently Terraform can only be used to provision admin SQL users, as this is a current limitation of the API, on which Terraform depends.
In CockroachDB Cloud, an organization corresponds to an authorization hierarchy linked to a billing account. Within each CockroachDB Cloud organization, the unit of database functionality is the CockroachDB cluster, which corresponds to a networked set of CockroachDB cluster nodes. SQL operations and data storage are distributed over a cluster. Every cluster belongs to an organization. CockroachDB Cloud has a hierarchical authorization model, where roles can be assigned at different scopes:
  1. Organization: A CockroachDB Cloud organization assigns permissions based on roles assigned to a Cloud Console user account, which allow these accounts to perform administrative tasks relating to the management of clusters, Console user management, SQL user management, and billing.
  2. Folder: Cloud Console roles can be assigned to a folder containing a group of clusters. Role inheritance is transitive; a role applied with the organization or folder scope is inherited by descendent resources.
Organizing clusters using folders is available in . To learn more, refer to .
  1. Cluster: Each CockroachDB cluster defines its own set of and SQL user which manage permission to execute SQL statements on the cluster.
The levels within the hierarchy intersect, because administering SQL-level users on specific clusters within an organization is an organization-level function.
SQL users are granted a distinct set of roles and privileges that are specific to data management on the cluster, independent of the Cloud user roles and permissions described on this page. For the main pages covering users and roles at the SQL level within a specific database cluster, refer to the main
. The SQL statement cannot be used to assign Cloud roles and permissions.

​
Organization user roles

When a user or service account is first added to an organization, they are assigned the default Console role, Organization Member, which adds no permissions and only indicates membership in the organization. Users with the Organization or Cluster Admin role may in the CockroachDB Cloud Console’s Access Management page, or using the CockroachDB Cloud API or Terraform Provider.
The user who creates a new organization is assigned the following at the organization scope:
Any of these roles may subsequently be removed by a user with both the Organization Admin role and the Cluster Admin role at the organization scope. This is to ensure that at least one user has both of these roles.
To learn more, refer to . The following table describes the high level permissions given by each CockroachDB Cloud user role. Permissions are additive, so a user with multiple roles is given all permissions in each area across all assigned roles. Some roles can be assigned to users at specific levels of scope to provide more granular permission control: The following sections describe the available CockroachDB Cloud roles in more detail:

​
Organization Member

The Organization Member role is assigned by default to all organization users when they are invited or provisioned. This role gives no additional permissions.

​
Organization Admin

The Organization Admin role allows users to perform the following actions:
  • .
  • .
  • Assign and revoke Cloud roles for both and .
Organization Admins automatically receive about planned cluster maintenance and when CockroachDB Cloud detects that a cluster is overloaded or experiencing issues. In addition, Organization Admins can subscribe other members to the email alerts, and configure how alerts work for the organization. This role can be assigned only at the organization scope.

​
Auditor

The Auditor role is in and is not enabled by default. To enroll your organization, contact your Cockroach Labs account team.
The Auditor role grants read-only visibility into an organization’s configuration and activity, for separation-of-duties and compliance use cases such as integrating with identity-governance platforms. It includes no write permissions and no access to cluster data. Users and service accounts with this role can view:
  • Organization settings, , and .
  • .
  • Organization members and their role assignments, pending invitations, user groups, and the directory.
  • Authentication configuration: authentication methods, JWT issuer configuration, and status.
  • and API key metadata, such as key names and creation dates. API key secrets are never visible.
  • The hierarchy, the list of clusters, and each cluster’s metadata, node status, and cluster settings.
  • Each cluster’s configuration: IP allowlist, VPC peering, private endpoint trusted owners, and .
  • Each cluster’s , backup configuration, and restore history; , blackout windows, and version deferral settings; configuration; PCI DSS readiness status; and OpenTelemetry integration configuration; and .
The Auditor role does not include:
  • Any write or management action.
  • Access to the , the , or any other SQL or data access.
  • Performance monitoring: , , or .
  • details.
  • Migration Assistant artifacts, which can contain schema and statement content.
The Auditor role is not a subset of the Organization Admin role. It includes read access to per-cluster configuration, such as networking, backups, and CMEK, that the Organization Admin role does not have.
This role can be assigned only at the organization scope.

​
Billing Coordinator

The Billing Coordinator role allows users to through the CockroachDB Cloud console billing page at https://cockroachlabs.cloud/billing/overview.

​
Billing Viewer

The Billing Viewer role allows users to through the CockroachDB Cloud console billing page at https://cockroachlabs.cloud/billing/overview.

​
Cluster Operator

The Cluster Operator role allows actions that are dependent on whether it is assigned to a user or a service account.
  • Users with this role can perform the following console operations:
    • View a cluster’s , which displays its settings, attributes and statistics, including cloud provider, region topography, and available and maximum storage and request units.
    • Manage a cluster’s databases from the .
    • .
    • View and configure a cluster’s authorized networks from the .
    • for a cluster.
    • View backups in a cluster’s .
    • .
    • View a cluster’s Jobs from the .
    • View a cluster’s Metrics from the .
    • View a cluster’s Insights from the .
    • a cluster’s major version of CockroachDB.
    • View a cluster’s .
    • Send a test alert from the .
    • Configure single sign-on (SSO) enforcement.
    • Access the .
    • Configure a cluster’s .
    • .
  • Service accounts with this role can perform the following API operations:
    • .
    • .
    • .
    • for a cluster.
    • .
    • .
This role can be considered a more restricted alternative to Cluster Admin, as it gives all of the permissions of that role but does not allow users to:
  • Manage cluster-scoped roles on organization users.
  • Manage SQL users from the cloud console.
  • Create or delete a cluster.
This role can be assigned at the scope of the organization, on an individual cluster, or on a folder. If assigned to a folder, the role is inherited on the folder’s clusters, descendent folders, and their descendants.

​
Cluster Admin

The Cluster Admin role allows users to perform all Cluster Operator actions, as well as the following:
  • .
  • .
  • Edit cluster-scope role assignments (specifically, the Cluster Admin, Cluster Operator, and Cluster Developer roles) on , and .
  • .
  • Cluster Admins for the whole organization (rather than scoped to a single cluster) can .
  • Access the .
  • Configure a cluster’s .
This role can be assigned at the scope of the organization, on an individual cluster, or on a folder. If assigned to a folder, it is inherited on the folder’s clusters, descendent folders, and their descendants.

​
Cluster Data Accessor

The Cluster Data Accessor role is in and is not enabled by default. To enroll your organization, contact your Cockroach Labs account team.
The Cluster Data Accessor role grants SQL and data access to clusters with no control-plane cluster management. It is a subset of the Cluster Admin role, intended for users who need to work with a cluster’s data but should not manage the cluster’s infrastructure, security, or lifecycle. Users and service accounts with this role can:
  • Execute SQL statements from the Cloud Console , using the , or through the .
  • Authenticate to the cluster’s SQL interface using .
  • Manage a cluster’s databases from the .
  • Access the , including admin-level DB Console access. Refer to the note below.
  • View cluster information, node status, cluster settings (read-only), and the hierarchy.
Both the Cloud Console and admin-level DB Console access run as the root SQL user, the same as for the Cluster Admin role, so a Cluster Data Accessor has full SQL access to the cluster’s data. The Cloud Console restrictions described here limit what this role can see and do in the Cloud Console; they are not security boundaries for the underlying data.
The Cluster Data Accessor role holds the permissions required to use the DB Console, but the Cloud Console does not currently display the DB Console button or the Connect dialog for users with only this role, because those controls also require read access to the cluster’s IP allowlist and SQL users. Users with only this role can connect using the Cloud Console SQL Shell, with ccloud cluster sql --sso, or a connection string provided by a cluster administrator.
The Cluster Data Accessor role does not include:
  • SQL user management from the Cloud Console (the cluster’s SQL Users page), or role and membership management.
  • The cluster monitoring pages: , , and .
  • Cluster management, including creating, editing, scaling, or deleting clusters; ; (IP allowlist, VPC peering, private endpoints, and egress rules), including viewing it; CMEK; versions and maintenance; metrics and log export; physical cluster replication; and usage and billing.
This role can be assigned at the scope of the organization, on an individual cluster, or on a folder. If assigned to a folder, it is inherited on the folder’s clusters, descendent folders, and their descendants.

​
Cluster Creator

The Cluster Creator role allows users to create clusters in an organization. A cluster’s creator is automatically assigned the Cluster Admin role for that cluster upon creation. This role can be assigned at the scope of the organization or on a folder. If assigned to a folder, it is inherited on the folder’s clusters, descendent folders, and their descendants.

​
Cluster Developer

The Cluster Developer role allows users to view cluster details and access the , allowing them to , although they will still need a Cluster Admin to for the cluster. This role can be assigned at the scope of the organization, on an individual cluster, or on a folder. If assigned to a folder, it is inherited on the folder’s clusters, descendent folders, and their descendants.

​
Cluster Monitor

The Cluster Monitor role provides read‑only visibility into SQL activity and workload health without broader administrative privileges. Users with this role can view the SQL Activity pages (, , and ), the , and the . This role can be assigned at the scope of the organization, on an individual cluster, or on a folder. If assigned to a folder, it is inherited on the folder’s clusters, descendent folders, and their descendants.

​
Metrics Viewer

The Metrics Viewer role grants read‑only access to observability metrics for a cluster without any administrative or data‑manipulation privileges.
  • Users with this role can view a cluster’s Metrics from the .
  • Service accounts with this role can access the and the to integrate with external observability systems.
This role can be assigned at the scope of the organization, on an individual cluster, or on a folder. If assigned to a folder, it is inherited on the folder’s clusters, descendent folders, and their descendants.
To give a developer the ability to both connect to a cluster and monitor performance with least privilege, combine Cluster Developer with Metrics Viewer (and optionally Cluster Monitor).

​
Folder Admin

The Folder Admin role allows users to create, rename, move, delete, and manage access to folders where they are assigned the role. Users can also . This role can be assigned at the level of the organization or on a specific folder. If assigned at the level of the organization, the role allows users to view all users and service accounts in the organization. If assigned to a specific folder, the role is inherited by descendant folders. A user with the Organization Admin role can assign themselves, another user, or a service account the Folder Admin role. To create or manage clusters in a folder, a Folder Admin also needs the Cluster Admin or Cluster Creator role on that folder directly or by inheritance. To delete a cluster, the Cluster Admin role is required on the cluster directly or by inheritance.

​
Folder Mover

The Folder Mover role allows users to rename or move descendant folders, and move clusters within the folder hierarchy where they have the role. However, a Folder Mover cannot create or delete folders or clusters and cannot assign roles. A Folder Mover can move clusters within the folder hierarchy even if they do not have a role that allows them to connect to the cluster, such as Cluster Creator or Cluster Operator.
A cluster inside a folder cannot be renamed.
A user with the Organization Admin or Folder Admin role can assign another user or a service account the Folder Mover role. Because the Folder Admin role is a superset of Folder Mover, there is no need for a Folder Admin to assign themselves the Folder Mover role.

​
Service accounts

Service accounts authenticate with API keys to the CockroachDB Cloud API, rather than to the CockroachDB Cloud Console UI. Service accounts operate under a unified authorization model with organization users, and can be assigned all of the same roles as users, but note that some actions are available in the console but not the API, or vice versa (For example, in the Cluster Operator Role). Refer to .

​
Cluster roles for organization users using cluster SSO

Cluster Single Sign-On (SSO) for CockroachDB Cloud allows authorized organization users to directly access clusters within the organization via , the CockroachDB Cloud command line interface. However, because organization users and cluster SQL users are logically separate, a corresponding SQL user must be created for each SSO organization user, on each particular cluster. This correspondence lies in the SQL user name, which must be in the format sso_{email_name}. Replace (email_name} with the portion of the user’s email address before @. For example, the SQL username of a user with the email address docs@cockroachlabs.com is sso_docs. If the role is not set up correctly, ccloud prompts you to create or add it. Only an SQL admin can manage SQL users.