Skip to main content
Account-level permissions apply to the whole Firebolt deployment rather than to one object: each covers every current and future database, location, role or user of its kind. They are granted and revoked without an ON clause.
Revoking a privilege removes it from a role but does not explicitly deny the privilege. If the privilege was not previously granted, revoking it has no effect.
For more detailed information about location permissions and their usage, see Location permissions.

​
Examples of granting account-level permissions

​
CREATE DATABASE permission

The following code example grants the role developer_role permission to create new databases:

​
USAGE ANY DATABASE permission

The following code example gives permission to the role developer_role to access all current and future databases:

​
MODIFY ANY DATABASE permission

The following code example grants the role developer_role permission to modify or delete all current and future databases:

​
CREATE ENGINE permission

The following code example gives the role developer_role permission to create new engines:

​
USAGE ANY ENGINE permission

The following code example grants the role developer_role permission to use all current and future engines:

​
OPERATE ANY ENGINE permission

The following code example gives the role developer_role permission to start and stop all current and future engines:

​
MODIFY ANY ENGINE permission

The following code example grants the role developer_role permission to modify or delete all current and future engines:

​
CREATE ROLE permission

The following code example gives the role developer_role permission to create new roles:

​
MODIFY ANY ROLE permission

The following code example grants the role developer_role permission to modify or delete all current and future roles:

​
CREATE USER permission

The following code example gives the role developer_role permission to create new users:

​
MODIFY ANY USER permission

The following code example grants the role developer_role permission to modify or delete all current and future users:

​
MONITOR [ANY USAGE] permission

The following code example grants the role developer_role permission to see the query history and currently running queries on all the engines:

​
CREATE LOCATION permission

The following code example grants role my_role permission to create locations:

​
MODIFY ANY LOCATION permission

The following code example grants role my_role permission to modify or delete all current and future locations:

​
USAGE ANY LOCATION permission

The following code example grants role my_role permission to use all current and future locations: