clickhouse-enterprise-rbac

# ClickHouse Enterprise RBAC ## Overview Implement enterprise-grade role-based access control in ClickHouse using SQL-based user management, hierarchical roles, row-level policies, and quotas. ## Prerequisites - ClickHouse with `access_management = 1` enabled (default in Cloud) - Admin user with `GRANT OPTION` ## Instructions ### Step 1: Create Users with Authentication ```sql -- SHA256 password (standard) CREATE USER app_backend IDENTIFIED WITH sha256_password BY 'strong-password-here' DEFAULT DATABASE analytics HOST IP '10.0.0.0/8' -- Restrict to VPC SETTINGS max_memory_usage = 10000000000, -- 10GB per query max_execution_time = 60; -- 60s timeout -- Double SHA1 (MySQL wire protocol compatible) CREATE USER legacy_app IDENTIFIED WITH double_sha1_password BY 'password' DEFAULT DATABASE analytics; -- bcrypt (strongest, slowest — use for admin accounts) CREATE USER admin_user IDENTIFIED WITH bcrypt_password BY 'admin-password'; -- Verify user was created SHOW CREATE USER app_backend; SELECT name, host_ip, default_database FROM system.users; ``` ### Step 2: Create Role Hierarchy ```sql -- Base roles (leaf-level permissions) CREATE ROLE data_reader; GRANT SELECT ON analytics.* TO data_reader; CREATE ROLE data_writer; GRANT INSERT ON analytics.* TO data_writer; CREATE ROLE schema_manager; GRANT CREATE TABLE, ALTER TABLE, DROP TABLE ON analytics.* TO schema_manager; -- Composite roles (inherit from base ro...