Users and user privileges in Managed Service for PostgreSQL®

When you create a cluster in Managed Service for PostgreSQL, you set names for a default database and a default user (also called bootstrap user). After that, connect to the cluster as the bootstrap user and create other users.

Do not routinely work with the cluster as the bootstrap user. Create other users with the necessary privileges and leave the bootstrap user as a fallback in case of emergency.

Bootstrap user privileges

The bootstrap user is not a superuser but has administrative privileges. It has the msp_admin and msp_superuser roles defined in Managed Service for PostgreSQL.

msp_admin gives the following privileges:
- pg_monitor and pg_signal_backend predefined roles.
- Subscription for logical replication (CREATE | DROP | ALTER SUBSCRIPTION).
- Ability to enable extensions (CREATE EXTENSION).
- Extension-specific functions: pg_stat_reset() and pg_stat_statements_reset() from the pg_stat_statements extension.
msp_superuser enables you to bypass ownership verification when you grant and revoke privileges.

When you connect as the bootstrap user and create new users, you can grant them the msp_admin role but not the msp_superuser role.

Prerequisites

To create or delete database users, connect to the cluster via psql as a user with administrative privileges. If you use the web console to change the bootstrap user password, you don’t need to complete any additional prerequisites. If you use the CLI, Terraform or an SDK to change the bootstrap user password, install and configure one of the following tools:

CLI
Terraform
Go SDK
Python SDK
JavaScript SDK

Install and configure the Nebius AI Cloud CLI.

How to manage users

Create a new user

Connect to the cluster via psql as a user with administrative privileges (for example, the bootstrap user).
Create a new user with privileges to connect to a <test_db> database. Execute the following SQL statements:
CREATE USER <db_user> PASSWORD '<password>'; GRANT CONNECT ON DATABASE <test_db> TO <db_user>;
<db_user> can connect to the <test_db> database and work with the data. The following usernames are reserved, do not specify them: admin, repl, monitor, postgres, public and none.
(Optional) If you need to grant them additional privileges for the database:
1. Connect to the cluster as the user that owns the <test_db> database. Usually, the database owner is the user who created it. Alternatively, connect as the bootstrap user to bypass the database ownership check.
2. Execute the following SQL statement:
  GRANT ALL PRIVILEGES ON DATABASE <test_db> TO <db_user>;

See more details on user roles and privileges in the PostgreSQL documentation.

Create a new user with administrative privileges

To create a user with administrative privileges, connect as the bootstrap user and execute the following SQL statements:

CREATE USER <new_admin> CREATEDB CREATEROLE PASSWORD '<password>';
GRANT msp_admin TO <new_admin>;

<new_admin> can create databases, create users, and grant them privileges. The msp_admin role lets them bypass checks when interacting with data. You cannot grant the msp_superuser role. You can grant any predefined roles except for the following:

role_pg_read_server_files
role_pg_write_server_files
role_pg_execute_server_program
role_pg_read_all_data
role_pg_write_all_data

The following usernames are reserved, do not specify them: admin, repl, monitor, postgres, public and none.

Manage the bootstrap user

Change the password for the bootstrap user only via Nebius AI Cloud interfaces: web console, CLI, Terraform provider, or SDKs. Don’t change it by using SQL statements, as the password will eventually be reset to the one created via Nebius AI Cloud interfaces.

To change the password of the bootstrap user:

In the sidebar, go to PostgreSQL.
Click your cluster and go to Settings.
In the Database section, enter the new password.
Click Update cluster.

Run the following command:

nebius msp postgresql v1alpha1 cluster update \
   --id <cluster_ID> \
   --parent-id <project_ID> \
   --bootstrap-user-password <new_password>

In your Terraform configuration (main.tf), change the value of bootstrap.user_password within the nebius_msp_postgresql_v1alpha1_cluster resource:

resource "nebius_msp_postgresql_v1alpha1_cluster" "<cluster_name>" {
  ...
  bootstrap = {
    db_name       = "<default_db_name>"
    user_name     = "<bootstrap_username>"
    user_password = "<new_password>"
  }
  ...
}

Update the configuration:
terraform apply

passwordService := sdk.Services().MSP().PostgreSQL().
    V1Alpha1().Cluster()
passwordCluster, err := passwordService.Get(
    ctx,
    &pg.GetClusterRequest{
        Id: "<cluster_ID>",
    },
)
if err != nil {
    return fmt.Errorf("get: %w", err)
}
passwordSpec := passwordCluster.Spec
if passwordSpec.Bootstrap == nil {
    passwordSpec.Bootstrap = &pg.BootstrapSpec{}
}
passwordSpec.Bootstrap.UserPassword = "<new_password>"
passwordCluster.Metadata.ParentId = "<project_ID>"
passwordOperation, err := passwordService.Update(
    ctx,
    &pg.UpdateClusterRequest{
        Metadata: passwordCluster.Metadata,
        Spec:     passwordSpec,
    },
)
if err != nil {
    return fmt.Errorf("update: %w", err)
}
_, err = passwordOperation.Wait(ctx)
if err != nil {
    return fmt.Errorf("wait for update: %w", err)
}

In the code, update the following values:

GetClusterRequest.Id: The cluster ID.
passwordSpec.Bootstrap.UserPassword: The new password.
passwordCluster.Metadata.ParentId: The project ID.

password_service = pg.ClusterServiceClient(sdk)
password_cluster = await password_service.get(
    pg.GetClusterRequest(id="<cluster_ID>"),
)
password_spec = password_cluster.spec
password_spec.bootstrap.user_password = "<new_password>"
password_cluster.metadata.parent_id = "<project_ID>"
password_operation = await password_service.update(
    pg.UpdateClusterRequest(
        metadata=password_cluster.metadata,
        spec=password_spec,
    ),
)
await password_operation.wait()

In the code, update the following values:

GetClusterRequest.id: The cluster ID.
password_spec.bootstrap.user_password: The new password.
password_cluster.metadata.parent_id: The project ID.

const passwordService = new pg.ClusterService(sdk);
const passwordCluster = await passwordService.get(
  pg.GetClusterRequest.create({ id: "<cluster_ID>" }),
).result;
const passwordSpec = passwordCluster.spec;
passwordSpec.bootstrap ??= pg.BootstrapSpec.create();
passwordSpec.bootstrap.userPassword = "<new_password>";
passwordCluster.metadata.parentId = "<project_ID>";
const passwordOperation = await passwordService.update(
  pg.UpdateClusterRequest.create({
    metadata: passwordCluster.metadata,
    spec: passwordSpec,
  }),
).result;
await passwordOperation.wait();

In the code, update the following values:

GetClusterRequest.id: The cluster ID.
passwordSpec.bootstrap.userPassword: The new password.
passwordCluster.metadata.parentId: The project ID.

Delete a user

Do not delete the bootstrap user, as this may cause the service to malfunction.

To delete a user, connect to the cluster as a user with administrative privileges and execute the following SQL statement:

DROP USER <username>;

Postgres, PostgreSQL and the Slonik Logo are trademarks or registered trademarks of the PostgreSQL Community Association of Canada, and used with their permission.

Object Storage

Managed Service for PostgreSQL®

Container Registry

Users and user privileges in Managed Service for PostgreSQL®

Bootstrap user privileges

Prerequisites

How to manage users

Create a new user

Create a new user with administrative privileges

Manage the bootstrap user

Delete a user

​Bootstrap user privileges

​Prerequisites

​How to manage users

​Create a new user

​Create a new user with administrative privileges

​Manage the bootstrap user

​Delete a user

Bootstrap user privileges

Prerequisites

How to manage users

Create a new user

Create a new user with administrative privileges

Manage the bootstrap user

Delete a user