You are viewing the documentation for a prerelease version.

View Latest

Roles

    +
    A Couchbase role permits one or more resources to be accessed according to defined privileges.

    Roles and Privileges

    Couchbase roles each have a fixed association with a set of one or more privileges. Each privilege is associated with a resource. Privileges are actions such as Read, Write, Execute, Manage, Flush, and List; or a combination of some or all of these.

    Roles are of the following kinds:

    • Administative: Associated with cluster-wide privileges. Some of these roles are for administrators; who might manage cluster-configurations; or read statistics; or enforce security. Others are for users and user-defined applications that require access to specific, cluster-wide resources.

    • Bucket: Associated with bucket administration, collection management, and application access. Roles in this category can each be applied to one, to multiple, or to all buckets on the cluster.

    • Data, Views, and XDCR: Associated with the Data Service. This includes the reading, writing, monitoring, backing-up, and restoring of data; the administration of Views; and the administration of Cross Data-Center Replication (XDCR).

    • Other Services: Roles for the administration of services other than the Data Service. These roles are organized under the following categories: Eventing, Query & Index, Search, Analytics, Eventing, and Backup.

    • Mobile: Associated with the administration of Sync Gateway.

    When a user (meaning either an administrator or an application) attempts to access a resource, they must authenticate. The roles and privileges associated with the user-credentials thereby presented are checked by Couchbase Server. If the associated roles contain privileges that support the kind of access that is being attempted, access is granted; otherwise, it is denied.

    Roles in Relaton to Buckets

    All data within a bucket is contained within some collection, within some scope. Permissions conveyed by bucket-related roles may be restricted in any of the following ways:

    • By Bucket: Permissions apply to all data in the specified bucket: all scopes and collections are thus covered by the permissions.

    • By Bucket and Scope: Permissions apply only to the collections within the specified scope (or scopes), within the specified bucket.

    • By Bucket, Scope, and Collection: Permissions apply only to the data within the specified collection (or collections), within the specified scope (or scopes), within the specified bucket.

    For detailed information on scopes and collections, see Scopes and Collections.

    Commonly Used Roles

    Couchbase Server users can largely be categorized as administrators, developers, and applications. Each user-category is supported by a different subset of roles.

    • Administrators. Able to log into Couchbase Web Console and perform administrative tasks; but unable to read or write data.

      The administrative tasks available are divided into multiple admin roles. For example, the Cluster Admin role allows the management of all cluster features except security; while the Read-Only Admin role allows only the reading of statistics; and the Bucket Admin role allows management only of one or more buckets. See the Admin roles listed below for full details. Note that depending on the administrator’s assigned roles, the content of Couchbase Web Console changes: for example, the entire Security screen is only visible to Full Admin administrators; and to administrators who possess both the Local User Security Admin and the External User Security Admin roles.

    • Applications. Able to read or write data; but unable to log into Couchbase Web Console, or in any way modify cluster-settings. For example, the Data Reader and Data Writer roles allows data to be respectively read and written to one or more collections, within one or more scopes, within one or more buckets. Other application-intended roles are Application Access, Data DCP Writer, Data Backup & Restore, and Data Monitor. See below for details on each.

    • Developers. Can be given a selection of roles, allowing the right degree of data and console access. For example, the Read-Only Admin role allows the reading of cluster-statistics, while the Data Read and Data Write roles allow access to data on one or more buckets.

    The following list contains all roles supported by Couchbase Server, Enterprise Edition. Each role is explained by means of a description and (in most cases) a table: the table lists the privileges in association with resources. The header of each table states the role’s name, followed by its alias name in parentheses: alias names are used in commands and queries. In each table-body, where a privilege is associated with a resource, this is indicated with a check-mark. Where a privilege is not associated with a resource (or where association would not be applicable), this is indicated with a cross. Resources not referred to in a particular table have no privileges associated with them in the context of the role being described.

    Note that some roles grant access to Couchbase Web Console; while others do not. The set of features displayed within the console varies, according to role.

    Note also that any authentication failure will be logged in the log file for the resource on which access was attempted. See Manage Logging, for detailed information on using log files.

    Full Admin

    The Full Admin role (an Administrative role) supports full access to all Couchbase-Server features and resources, including those of security. The role allows access to Couchbase Web Console, and allows the reading and writing of bucket-data.

    This role is also available in Couchbase Server Community Edition.

    Cluster Admin

    The Cluster Admin role (an Administrative role) allows the management of all cluster features except security. The role allows access to Couchbase Web Console, but does not permit the writing of data.

    Role: Cluster Admin (cluster_admin)
    Resources Privileges
    Read Write Execute Manage

    Cluster (except Passwords)

    yes

    yes

    yes

    yes

    UI (except Passwords)

    yes

    yes

    yes

    yes

    Security (except Passwords)

    yes

    no

    no

    no

    Bucket Data

    no

    no

    no

    no

    Local User Security Admin

    The Local User Security Admin role (an Administrative role) allows the management of local user roles and the reading of all cluster statistics. The role does not permit the granting of the Full Admin, the Read-Only Admin, the Local User Security Admin, or the External User Security Admin role; and does not permit the administrator to change their own role (which therefore remains Local User Security Admin). The role supports access to Couchbase Web Console, but does not support the reading of data.

    Role: Local User Security Admin (security_admin_local)
    Resources Privileges
    Read Write Execute Manage

    Cluster

    yes

    no

    no

    no

    UI (except Local User Security)

    yes

    no

    no

    no

    Security (including UI)

    yes

    yes

    yes

    yes

    Bucket Data

    no

    no

    no

    no

    External User Security Admin

    The External User Security Admin role (an Administrative role) allows the management of local user roles and the reading of all cluster statistics. The role does not permit the granting of the Full Admin, the Read-Only Admin, the Local User Security Admin, or the External User Security Admin role; and does not permit the administrator to change their own role (which therefore remains External User Security Admin). The role supports access to Couchbase Web Console, but does not support the reading of data.

    Role: External User Security Admin (security_admin_external)
    Resources Privileges
    Read Write Execute Manage

    Cluster

    yes

    no

    no

    no

    UI (except External User Security)

    yes

    no

    no

    no

    Security (including UI)

    yes

    yes

    yes

    yes

    Bucket Data

    no

    no

    no

    no

    Read-Only Admin

    The Read-Only Admin role (an Administrative role) supports the reading of Couchbase Server-statistics: this includes registered usernames with roles and authentication domains, but excludes passwords. The role allows access to Couchbase Web Console.

    This role is also available in Couchbase Server Community Edition.

    Role: Read-Only Admin (ro_admin)
    Resources Privileges
    Read Write Execute Manage

    Cluster

    yes

    no

    no

    no

    UI (except Passwords)

    yes

    no

    no

    no

    Security (except Passwords)

    yes

    no

    no

    no

    Bucket Data

    no

    no

    no

    no

    External Stats Reader

    The External Stats Reader role (an Administrative role) allows access to the /metrics endpoint, for Prometheus integration. All statistics for all services can be read. The role does not allow access to Couchbase Web Console.

    Role: External Stats Reader (external_stats_reader)
    Resources Privileges
    Read Write Execute Manage

    Admin : stats_export

    yes

    no

    no

    no

    XDCR Admin

    The XDCR Admin role (an XDCR role) allows use of XDCR features, to create cluster references and replication streams. The role allows access to Couchbase Web Console.

    Role: XDCR Admin (replication_admin)
    Resources Privileges
    Read Write Execute Manage

    XDCR for Cluster and Bucket

    yes

    yes

    yes

    yes

    Bucket Data

    yes

    no

    no

    no

    Bucket Settings

    yes

    no

    no

    no

    UI (XDCR)

    yes

    yes

    yes

    yes

    UI (Other)

    yes

    no

    no

    no

    Query Curl Access

    The Query Curl Access role (a Query & Index role) allows the N1QL CURL function to be executed by an externally authenticated user. The user can access Couchbase Web Console, but cannot read data, other than that returned by the N1QL CURL function.

    Note that the Query Curl Access role should be assigned with caution, since it entails risk: CURL runs within the local Couchbase Server network; therefore, the assignee of the Query Curl Access role is permitted to run GET and POST requests on the internal network, while being themselves externally located.

    For an account of limitations on CURL, see CURL Function.

    In versions of Couchbase Server prior to 5.5, this role was referred to as Query External Access.

    Role: Query Curl Access (query_external_access)
    Resources Privileges
    Read Write Execute Manage

    Bucket : N1QL, curl

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Query System Catalog

    The Query System Catalog role (a Query & Index role) allows information to be looked up by means of N1QL in the system catalog: this includes system:indexes, system:prepareds, and tables listing current and past queries. This role is designed for troubleshooters, who need to debug queries. The role allows access to Couchbase Web Console, but does not permit the reading of bucket-items.

    Role: Query System Catalog (query_system_catalog)
    Resources Privileges
    Read Write Execute Manage List

    Bucket : N1QL, INDEX

    no

    no

    no

    no

    yes

    Bucket : N1QL, Meta

    yes

    no

    no

    no

    no

    UI

    yes

    no

    no

    no

    no

    Pools

    yes

    no

    no

    no

    no

    Manage Global Functions

    The Manage Global Functions role (a Query & Index role) allows global N1QL functions to be managed. The user can access Couchbase Web Console, but cannot read data.

    Role: Manage Global Functions (query_manage_global_functions)
    Resources Privileges
    Read Write Execute Manage

    N1QL, udf

    no

    no

    no

    yes

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Execute Global Functions

    The Execute Global Functions role (a Query & Index role) allows global N1QL functions to be executed. The user can access Couchbase Web Console, but cannot read data.

    Role: Execute Global Functions (query_execute_global_functions)
    Resources Privileges
    Read Write Execute Manage

    N1QL, udf

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Manage Scope Functions

    The Manage Scope Functions role (a Query & Index role) allows N1QL functions to be managed for a given scope, given corresponding specification of bucket. The user can access Couchbase Web Console, but cannot read data.

    Role: Manage Scope Functions (query_manage_functions)
    Resources Privileges
    Read Write Execute Manage

    Collection, Bucket, Scope: N1QL, udf

    no

    no

    no

    yes

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Execute Scope Functions

    The Execute Scope Functions role (a Query & Index role) allows N1QL functions to be executed for a given scope, given corresponding specification of bucket. The user can access Couchbase Web Console, but cannot read data.

    Role: Execute Scope Functions (query_execute_functions)
    Resources Privileges
    Read Write Execute Manage

    Collection, Bucket, Scope: N1QL, udf

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Manage Global External Functions

    The Manage Global External Functions role (a Query & Index role) allows global external language functions to be managed. The user can access Couchbase Web Console, but cannot read data.

    Role: Manage Global External Functions (query_manage_global_external_functions)
    Resources Privileges
    Read Write Execute Manage

    N1QL, udf_external

    no

    no

    no

    yes

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Execute Global External Functions

    The Execute Global External Functions role (a Query & Index role) allows global N1QL functions to be executed. The user can access Couchbase Web Console, but cannot read data.

    Role: Execute Global External Functions (query_execute_global_external_functions)
    Resources Privileges
    Read Write Execute Manage

    N1QL, udf_external

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Manage Scope External Functions

    The Manage Scope External Functions role (a Query & Index role) allows external language functions to be managed for a given scope, given corresponding specification of bucket. The user can access Couchbase Web Console, but cannot read data.

    Role: Manage Scope External Functions (query_manage_external_functions)
    Resources Privileges
    Read Write Execute Manage

    Collection, Bucket, Scope: N1QL, udf_external

    no

    no

    no

    yes

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Execute Scope External Functions

    The Execute Scope External Functions role (a Query & Index role) allows external language functions to be executed for a given scope, given corresponding specification of bucket. The user can access Couchbase Web Console, but cannot read data.

    Role: Execute Scope External Functions (query_execute_external_functions)
    Resources Privileges
    Read Write Execute Manage

    Collection, Bucket, Scope: N1QL, udf_external

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Analytics Reader

    The Analytics Reader role (an Analytics role) allows querying of shadow data-sets. This is defined as a global role because multiple buckets may be combined into a single shadow dataset. The role allows access to Couchbase Web Console, and permits the reading of data.

    Role: Analytics Reader (analytics_reader)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Analytics

    yes

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Analytics Admin

    The Analytics Admin role (an Analytics role) allows management of dataverses; management of all Analytics Service links; and management of all datasets. The role allows access to Couchbase Web Console, but does not permit the reading of data.

    Role: Analytics Admin (analytics_admin)
    Resources Privileges
    Read Write Execute Manage

    Dataverse : Analytics

    no

    no

    no

    yes

    Bucket : Analytics

    no

    no

    no

    yes

    Bucket : UI

    no

    no

    no

    no

    Other : UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Bucket Admin

    The Bucket Admin role (which is a Bucket role) allows the management of all per bucket features (including starting and stopping XDCR). The role allows access to Couchbase Web Console, but does not permit the reading or writing of data.

    Role: Bucket Admin (bucket_admin)
    Resources Privileges
    Read Write Execute Manage

    Cluster

    yes

    no

    no

    no

    Bucket (including XDCR)

    yes

    yes

    yes

    yes

    Bucket Data

    no

    no

    no

    no

    Bucket UI

    yes

    yes

    yes

    yes

    Other UI

    yes

    no

    no

    no

    Manage Collections in Scope

    The Manage Collections in Scope role (a Bucket role) allows the creation and deletion of collections per scope, given the corresponding specification of bucket. The role allows no access to data, and does not permit access to Couchbase Web Console. The role is intended for application use only.

    Role: Manage Collections in Scope (scope_admin)
    Resources Privileges
    Read Write Execute Manage

    Create and Delete Collections in a Given Scope

    no

    no

    yes

    yes

    UI

    no

    no

    no

    no

    Application Access

    The Application Access role (a Bucket role) provides read and write access to data, per bucket. The role does not allow access to Couchbase Web Console: it is intended for applications, rather than users. Note that this role is also available in the Community Edition of Couchbase Server.

    The role is provided in support of buckets that were created on versions of Couchbase Server prior to 5.0. Such buckets were accessed by specifying bucket-name and bucket-password: however, bucket-passwords are not recognized by Couchbase Server 5.0 and after. Therefore, for each pre-existing bucket, the upgrade-process for 5.0 and after creates a new user, whose username is identical to the bucket-name; and whose password is identical to the former bucket-password, if one existed. If no bucket-password existed, the user is created with no password. This migration-process allows the same name-combination as before to be used in authentication. To ensure backwards compatibility, each system-created user is assigned the Application Access role, which authorizes the same read-write access to bucket-data as was granted before 5.0.

    Use of the Application Access role is deprecated for buckets created on Couchbase Server 5.0 and after: use the other bucket-access roles provided. Note that in versions of Couchbase Server prior to 5.5, this role was referred to as Bucket Full Access.

    Role: Application Access (bucket_full_access)
    Resources Privileges
    Read Write Execute Manage Flush

    Bucket Data

    yes

    yes

    yes

    yes

    no

    Bucket Views

    yes

    yes

    yes

    yes

    no

    N1QL: Index

    yes

    yes

    yes

    yes

    no

    N1QL: Other

    yes

    yes

    yes

    no

    no

    Bucket

    yes

    no

    no

    no

    yes

    Pools

    yes

    no

    no

    no

    no

    XDCR Inbound

    The XDCR Inbound role (which is an XDCR role) allows the creation of inbound XDCR streams, per bucket. It does not allow access to Couchbase Web Console, and does not permit the reading of data.

    In versions of Couchbase Server prior to 5.5, this role was referred to as Replication Target.

    Role: XDCR Inbound (replication_target)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Settings

    yes

    no

    no

    no

    Bucket : Meta

    yes

    yes

    no

    no

    Bucket : Stats

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Sync Gateway

    The Sync Gateway role (which is a Mobile role) allows full access to data per bucket, as required by Sync Gateway. The role does not allow access to Couchbase Web Console. The user can, by means of Sync Gateway, read and write data, manage indexes and views, and read some cluster information.

    Role: Sync Gateway (mobile_sync_gateway)
    Resources Privileges
    Read Write Execute Manage

    UI

    no

    no

    no

    no

    Bucket : Data

    yes

    yes

    yes

    yes

    Bucket : Views

    yes

    yes

    yes

    yes

    Bucket : Indexes

    yes

    yes

    yes

    yes

    Bucket : Query

    yes

    yes

    yes

    no

    Bucket : Flush

    yes

    no

    yes

    no

    Bucket : Settings

    yes

    no

    no

    no

    Auto-compaction

    yes

    no

    no

    no

    Admin: Memcached: Idle

    no

    yes

    no

    no

    Pools

    yes

    no

    no

    no

    Data Reader

    The Data Reader role (which is a Data role) allows data to be read per collection, given corresponding specifications for bucket and scope. Note that the role does not permit the running of N1QL queries (such as SELECT) against data. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users.

    Role: Data Reader (data_reader)
    Resources Privileges
    Read Write Execute Manage

    Bucket Docs

    yes

    no

    no

    no

    Bucket : Meta

    yes

    no

    no

    no

    Bucket : Xattr

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Data Writer

    The Data Writer role (which is a Data role) allows data to be written per collection, given corresponding specifications for bucket and scope. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users.

    Role: Data Writer (data_writer)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Docs

    no

    yes

    no

    no

    Bucket : Xattr

    no

    yes

    no

    no

    Pools

    yes

    no

    no

    no

    Data DCP Reader

    The Data DCP Reader role (which is a Data role) allows DCP streams to be initiated per collection, given corresponding specifications for bucket and scope. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users. The role does allow the reading of data.

    Role: Data DCP Reader (data_dcp_reader)
    Resources Privileges
    Read Write Execute Manage

    Bucket: : Data

    yes

    no

    no

    no

    Bucket: : Meta

    yes

    no

    no

    no

    Bucket: : DCP

    yes

    no

    no

    no

    Bucket: : Sxattr

    yes

    no

    no

    no

    Bucket: : Xattr

    yes

    no

    no

    no

    Admin: Memcached: Idle

    no

    yes

    no

    no

    Pools

    yes

    no

    no

    no

    Data Backup & Restore

    The Data Backup & Restore role (which is a Data role) allows data to be backed up and restored, per bucket. The role supports the reading of data. The role does not allow access to Couchbase Web Console: it is intended to support applications, rather than users.

    The privileges represented in this table are, from left to right, Read, Write, Execute, Manage, Select, Backup, Create, List, and Build.

    Role: Data Backup & Restore (data_backup)
    Resources Privileges
    Rd Wrt Exec Mng Slct Bckp Crt Lst Bld

    Bucket: : Data

    yes

    yes

    no

    no

    no

    no

    no

    no

    no

    Bucket: : Views

    yes

    yes

    no

    no

    no

    no

    no

    no

    no

    Bucket: : FTS

    yes

    yes

    no

    yes

    no

    no

    no

    no

    no

    Bucket: : Stats

    yes

    no

    no

    no

    no

    no

    no

    no

    no

    Bucket: : Settings

    yes

    no

    no

    no

    no

    no

    no

    no

    no

    Bucket: : N1QL, Index

    no

    no

    no

    no

    no

    no

    yes

    yes

    yes

    Bucket: : Analytics

    no

    no

    no

    yes

    no

    no

    no

    no

    no

    Analytics:

    no

    no

    no

    no

    yes

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    no

    no

    no

    no

    no

    Data Monitor

    The Data Monitor role (which is a Data role) allows statistics to be read per collection, given corresponding specifications for bucket and scope. It does not allow access to Couchbase Web Console, and does not permit the reading of data. This role is intended to support application-access, rather than user-access.

    In versions of Couchbase Server prior to 5.5, this role was referred to as Data Monitoring.

    Role: Data Monitor (data_monitoring)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Stats

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Views Admin

    The Views Admin role (which is a Views role) allows the management of views, per bucket. The role allows access to Couchbase Web Console.

    Role: Views Admin (views_admin)
    Resources Privileges
    Read Write Execute Manage

    Bucket Data (Views)

    yes

    yes

    yes

    yes

    Bucket Data (Other)

    yes

    no

    no

    no

    Bucket Settings

    yes

    no

    no

    no

    UI (Views)

    yes

    yes

    yes

    yes

    UI (Other)

    yes

    no

    no

    no

    Views Reader

    The Views Reader role (which is an Administrative role) allows data to be read from views, per bucket. This role does not allow access to Couchbase Web Console, and is intended to support applications, rather than users.

    Role: Views Reader (views_reader)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Docs

    yes

    no

    no

    no

    Bucket : Views

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Query Select

    The Query Select role (which is a Query & Index role) allows the SELECT statement to be executed per collection, given corresponding specifications for bucket and scope. This role allows access to Couchbase Web Console, and supports the reading of data.

    Role: Query Select (query_select)
    Resources Privileges
    Read Write Execute Manage

    Bucket : N1QL, SELECT

    yes

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Query Update

    The Query Update role (which is a Query & Index role) allows the UPDATE statement to be executed per collection, given corresponding specifications for bucket and scope. The role supports access to Couchbase Web Console, but does not allow the reading of data.

    Role: Query Update (query_update)
    Resources Privileges
    Read Write Execute Manage

    Bucket : N1QL, UPDATE

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Query Insert

    The Query Insert role (which is a Query & Index role) allows the INSERT statement to be executed per collection, given corresponding specifications for bucket and scope. The role supports access to Couchbase Web Console, but does not allow the reading of data.

    Role: Query Insert (query_insert)
    Resources Privileges
    Read Write Execute Manage

    Bucket : N1QL, INSERT

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Query Delete

    The Query Delete role (which is a Query & Index role) allows the DELETE statement to be executed per collection, given corresponding specifications for bucket and scope. The role supports access to Couchbase Web Console, but does not allow the reading of data.

    Role: Query Delete (query_delete)
    Resources Privileges
    Read Write Execute Manage

    Bucket : N1QL, DELETE

    no

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Query Manage Index

    The Query Manage Index role (which is a Query & Index role) allows indexes to be managed per collection, given corresponding specifications for bucket and scope. The role allows access to Couchbase Web Console, but does not permit the reading of data.

    Role: Query Manage Index (query_manage_index)
    Resources Privileges
    Read Write Execute Manage

    Bucket : N1QL, INDEX

    yes

    yes

    yes

    yes

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Eventing Full Admin

    The Eventing Full Admin role (which is an Eventing role) allows creation and management of eventing functions. The role allows access to Couchbase Web Console.

    Role: Eventing Full Admin (eventing_admin)
    Resources Privileges
    Read Write Execute Manage

    Data

    yes

    yes

    yes

    yes

    N1QL

    yes

    yes

    yes

    yes

    Eventing

    yes

    yes

    yes

    yes

    Analytics

    yes

    yes

    yes

    yes

    UI

    yes

    yes

    no

    yes

    Backup Full Admin

    The Backup Full Admin role (which is a Backup role) allows performance of backup-related tasks. The role allows access to Couchbase Web Console.

    Role: Backup Full Admin (backup_admin)
    Resources Privileges
    Read Write Execute Manage

    Data

    yes

    yes

    no

    yes

    Cluster Settings

    yes

    yes

    no

    yes

    Bucket Settings

    yes

    yes

    no

    yes

    Backup Service

    yes

    yes

    yes

    yes

    UI

    yes

    yes

    no

    yes

    Search Admin

    The Search Admin role (which is a Search role) allows management of all features of the Search Service, per bucket. The role allows access to Couchbase Web Console.

    In versions of Couchbase Server prior to 5.5, this role was referred to as FTS Admin.

    Role: Search Admin (fts_admin)
    Resources Privileges
    Read Write Execute Manage

    Bucket Data (Search)

    yes

    yes

    yes

    yes

    Bucket Data (Other)

    yes

    no

    no

    no

    Bucket Settings

    yes

    no

    no

    no

    UI (Search)

    yes

    yes

    yes

    yes

    UI (Other)

    yes

    no

    no

    no

    Services and Curl

    no

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Search Reader

    The role Search Reader (which is a Search role) allows Full Text Search indexes to be searched, per collection, given corresponding specification of bucket and scope. The role allows access to Couchbase Web Console, and supports the reading of data.

    In versions of Couchbase Server prior to 5.5, this role was referred to as FTS Searcher.

    Role: Search Reader (fts_searcher)
    Resources Privileges
    Read Write Execute Manage

    Bucket : FTS

    yes

    no

    no

    no

    Settings: FTS

    yes

    no

    no

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Analytics Select

    The Analytics Select role (which is an Analytics role) allows the querying of datasets created per collection, given corresponding specification of bucket and scope. The role allows access to Couchbase Web Console, and permits the reading of some data.

    Role: Analytics Select (analytics_select)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Analytics

    yes

    no

    yes

    no

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    Analytics Manager

    The Analytics Manager role (which is an Analytics role) allows the management and querying of datasets created per bucket; and the management of Analytics Service local links. The role allows access to Couchbase Web Console, and permits the reading of some data.

    Role: Analytics Manager (analytics_manager)
    Resources Privileges
    Read Write Execute Manage

    Bucket : Analytics

    yes

    no

    yes

    yes

    UI

    yes

    no

    no

    no

    Pools

    yes

    no

    no

    no

    System Keyspaces (Tables)

    The following system keyspaces are provided:

    System Catalogs

    Monitoring Catalogs

    Security Catalogs

    SELECT Operations on System Keyspaces

    All of the system keyspaces support SELECT operations and are divided into the below security levels:

    concepts rba for apps table SELECT