@Rocky I want to make a custom user role that is read only AND has the ability to view the UI, what's the best way to do that?

To create a custom read-only user role that also has the ability to view the StarRocks Web UI, you need to combine custom data privileges with specific system-level roles. In StarRocks (especially v3.x), access to the built-in FE Web UI (typically at

http://<FE_IP>:8030

) is restricted to users with administrative roles. Step 1: Create the Custom Read-Only Role This role grants the user the ability to query data across all catalogs and databases without the ability to modify or drop objects.

sql
-- 1. Create the role
CREATE ROLE read_only_user;

-- 2. Grant usage on catalogs
GRANT USAGE ON ALL CATALOGS TO ROLE read_only_user;

-- 3. Grant SELECT privileges on all tables, views, and materialized views
GRANT SELECT ON ALL TABLES IN ALL DATABASES TO ROLE read_only_user;
GRANT SELECT ON ALL VIEWS IN ALL DATABASES TO ROLE read_only_user;
GRANT SELECT ON ALL MATERIALIZED VIEWS IN ALL DATABASES TO ROLE read_only_user;

-- 4. (Optional) Grant USAGE on functions
GRANT USAGE ON ALL FUNCTIONS IN ALL DATABASES TO ROLE read_only_user;
GRANT USAGE ON ALL GLOBAL FUNCTIONS TO ROLE read_only_user;

Step 2: Enable Web UI Access According to the StarRocks documentation, accessing the FE Web Console requires one of the system-defined administrative roles. * For the FE Web UI (v3.0+): The user typically must have the

cluster_admin

role to access the console. * For the FE Web UI (Earlier versions): Sometimes

db_admin

and

user_admin

are required. Important Security Note: Because

cluster_admin

includes the

NODE

privilege (which allows adding/dropping nodes), StarRocks does not currently have a "View-Only" role for the internal FE Web UI. To give a user read-only data access + UI access, you would grant both:

sql
-- Assign the custom read-only role
GRANT read_only_user TO USER 'your_user'@'%';

-- Assign cluster_admin to allow Web UI login
GRANT cluster_admin TO USER 'your_user'@'%';

-- Set the default role so they don't have to 'SET ROLE' manually
ALTER USER 'your_user'@'%' DEFAULT ROLE read_only_user, cluster_admin;

Best Practice Recommendations 1. Least Privilege: Since

cluster_admin

allows node management, be cautious. If the user only needs to see metrics, it is often better to use Grafana (connected to StarRocks via Prometheus) rather than giving them direct FE UI access. 2. StarRocks Manager: If you are using the StarRocks Manager (a separate management platform), it provides a much more granular "Viewer" role that is independent of the database's

cluster_admin

privilege. This is the preferred way to provide read-only UI access in production environments. 3. Query Profiles: If the user needs the UI specifically to see Query Profiles, they can also view these via SQL using the

information_schema.tasks

or by running

EXPLAIN ANALYZE <query>

in their SQL clients like DBeaver or MySQL Shell, which doesn't require UI access. References • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/cluster-management/nodes_processes/ALTER_SYSTEM.md