http://starrocks.io logo
Join Slack
Powered by
This message was deleted.
# questions-and-troubleshooting
s
This message was deleted.
r
To fix this issue, you need to grant the 
CREATE STORAGE VOLUME
 privilege at the SYSTEM level to the user 
elastic_consumer
. In StarRocks, storage volume management is a global system privilege. 1. SQL Fix Run the following command as a user with administrative privileges (e.g., 
root
or a user with the 
user_admin
role):
Copy code
sql
GRANT CREATE STORAGE VOLUME ON SYSTEM TO USER 'elastic_consumer'@'%';
(Note: Replace 
'%'
with the actual host if the user is restricted to a specific IP.) 2. Update Policy Configuration Based on your configuration snippet, you need to add a new 
statement
block to your policy that targets the system resource. Adjust your policy as follows:
Copy code
hcl
policy "starrocks_core_services_sd_elastic_consumer" {
  # ... (existing statements)

  # New statement for system-level privileges
  statement {
    effect = "Allow"

    privileges = [
      "mysql:CREATE STORAGE VOLUME",
    ]

    resources = [
      "mysql:system:${alias("starrocks-core-services-sd")}",
    ]
  }
}
Additional Considerations 1. Usage Privilege: Once the storage volume (e.g., 
core_services_volume
) is created, the user will also need the 
USAGE
privilege on that specific volume to use it for creating databases or tables. You can grant this via SQL:
Copy code
sql
    GRANT USAGE ON STORAGE VOLUME core_services_volume TO USER 'elastic_consumer'@'%';
2. Activation: If you are using roles, ensure the role is active. The error message indicates 
Current role(s): NONE
, which means the user is operating with their base privileges only. If these privileges were granted to a role instead of the user directly, the user must run 
SET ROLE <role_name>
or you must set it as a default role using 
ALTER USER elastic_consumer DEFAULT ROLE <role_name>
. name>`. 3. Version Requirement: Storage Volumes were introduced in StarRocks v3.1. Ensure your cluster is running v3.1 or higher. References • administration/user_privs/authorization/privilege_item.md • administration/user_privs/authorization/user_privs.md • sql-reference/sys/sys.md
m
@Rocky Is CREATE EXTERNAL CATALOG also server level privilege?
r
Yes, 
CREATE EXTERNAL CATALOG
 is also a SYSTEM-level privilege. In StarRocks v3.0 and later, creating an external catalog is considered a global operation. To grant this to your user, you would use: SQL Command
Copy code
sql
GRANT CREATE EXTERNAL CATALOG ON SYSTEM TO USER 'elastic_consumer'@'%';
Policy Configuration Add the privilege to the same 
system
resource block in your policy:
Copy code
hcl
policy "starrocks_core_services_sd_elastic_consumer" {
  # ... existing statements

  statement {
    effect = "Allow"

    privileges = [
      "mysql:CREATE STORAGE VOLUME",
      "mysql:CREATE EXTERNAL CATALOG", # Add this here
    ]

    resources = [
      "mysql:system:${alias("starrocks-core-services-sd")}",
    ]
  }
}
Note on Usage Once a catalog is created, other users (or the same user) will still need the 
USAGE
 privilege on that specific catalog to access its metadata and query its tables. • System level: 
CREATE EXTERNAL CATALOG
(the permission to build a new catalog). • Catalog level: 
USAGE
(the permission to use/see an existing catalog). References • sql-reference/sql-statements/Catalog/CREATE_EXTERNAL_CATALOG.md • administration/user_privs/authorization/privilege_item.md • administration/user_privs/authorization/User_privilege.md
m
@Rocky 2026-07-07T181331.457Z ERROR [StarRocks] failed to execute DDL {"query": "SET core_services_volume AS DEFAULT STORAGE VOLUME;", "error": "Error 5203 (42000): Access denied; you need (at least one of) the ALTER privilege(s) on STORAGE VOLUME core_services_volume for this operation. Please ask the admin to grant permission(s) or try activating existing roles using <set [default] role>. Current role(s): NONE. Inactivated role(s): NONE."} What other privilege i need
r
To resolve the error 
Access denied; you need (at least one of) the ALTER privilege(s) on STORAGE VOLUME core_services_volume
, you must grant the 
ALTER
 privilege on that specific storage volume to your user. While some documentation suggests 
USAGE
is enough, the error message explicitly requires 
ALTER
to change the "default" status of the volume. 1. SQL Fix Run the following command as an administrator:
Copy code
sql
GRANT ALTER, USAGE ON STORAGE VOLUME core_services_volume TO USER 'elastic_consumer'@'%';
2. Update Policy Configuration Add a new statement block to your policy targeting the specific storage volume resource. Note that this is a separate resource type from 
system
or 
database
.
Copy code
hcl
policy "starrocks_core_services_sd_elastic_consumer" {
  # ... (previous statements for SYSTEM and DATABASE)

  # New statement for the specific storage volume
  statement {
    effect = "Allow"

    privileges = [
      "mysql:USAGE",
      "mysql:ALTER (STORAGE VOLUME)",
    ]

    resources = [
      "mysql:storage_volume:${alias("starrocks-core-services-sd")}/core_services_volume",
    ]
  }
}
Summary of required privileges for this workflow: 1. 
CREATE STORAGE VOLUME
on 
SYSTEM
: To run the 
CREATE STORAGE VOLUME
command. 2. 
ALTER
on 
STORAGE VOLUME <name>
: To run 
SET ... AS DEFAULT STORAGE VOLUME
. 3. 
USAGE
on 
STORAGE VOLUME <name>
: To reference this volume when creating new databases or tables. References • sql-reference/sql-statements/cluster-management/storage_volume/SET_DEFAULT_STORAGE_VOLUME.md • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/account-management/GRANT.md References • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/cluster-management/storage_volume/ALTER_STORAGE_VOLUME.md • sql-reference/sql-statements/account-management/GRANT.md • sql-reference/sql-statements/cluster-management/storage_volume/CREATE_STORAGE_VOLUME.md • sql-reference/sql-statements/Database/ALTER_DATABASE.md • sql-reference/sql-statements/cluster-management/nodes_processes/ALTER_SYSTEM.md • sql-reference/sql-statements/cluster-management/storage_volume/DESC_STORAGE_VOLUME.md • sql-reference/sql-statements/cluster-management/storage_volume/DROP_STORAGE_VOLUME.md
m
@Rocky [StarRocks] failed to ensure events schema {"error": "exec \"CREATE TABLE IF NOT EXISTS events.events(\\n\\t\\trequest_time DATETIME NOT NULL,\\n\\t\\tauction_id STRING NOT NULL,\\n\\t\\timp_key STRING NOT NULL\\n\\t)\\n\\tPRIMARY KEY (request_time, auction_id, imp_key)\\n\\tPARTITION BY date_trunc('hour', request_time)\\n\\tDISTRIBUTED BY HASH (auction_id) BUCKETS 16\\n\\tORDER BY (request_time, auction_id)\\n\\tPROPERTIES (\\n\\t\\t\\\"storage_volume\\\" = \\\"core_services_volume\\\",\\n\\t\\t\\\"datacache.enable\\\" = \\\"true\\\",\\n\\t\\t\\\"datacache.partition_duration\\\" = \\\"5 DAY\\\",\\n\\t\\t\\\"enable_persistent_index\\\" = \\\"true\\\",\\n\\t\\t\\\"persistent_index_type\\\" = \\\"CLOUD_NATIVE\\\",\\n\\t\\t\\\"compression\\\" = \\\"ZSTD\\\",\\n\\t\\t\\\"fast_schema_evolution\\\" = \\\"true\\\",\\n\\t\\t\\\"partition_live_number\\\" = \\\"168\\\"\\n\\t);\": Error 5203 (42000): Access denied; you need (at least one of) the USAGE privilege(s) on STORAGE VOLUME core_services_volume for this operation. Please ask the admin to grant permission(s) or try activating existing roles using <set [default] role>. Current role(s): NONE. Inactivated role(s): NONE."} Is this also a mysql:storage_volume privilege need to grant?
r
Yes, this is exactly what you need. To fix the "Access denied" error during table creation, you must grant the 
USAGE
 privilege on the 
mysql:storage_volume
 resource. When you create a table and explicitly specify a 
storage_volume
in the 
PROPERTIES
, StarRocks checks if the user has permission to use that specific volume. Updated Policy Configuration Add (or update) the following statement in your policy. Ensure it includes both 
mysql:USAGE
(for creating tables) and 
mysql:ALTER (STORAGE VOLUME)
(for the previous error you saw regarding setting the default volume).
Copy code
hcl
policy "starrocks_core_services_sd_elastic_consumer" {
  # ... (other statements)

  statement {
    effect = "Allow"

    privileges = [
      "mysql:USAGE",
      "mysql:ALTER (STORAGE VOLUME)",
    ]

    resources = [
      "mysql:storage_volume:${alias("starrocks-core-services-sd")}/core_services_volume",
    ]
  }
}
SQL equivalent (for immediate testing) You can run this via a high-privilege account to verify it fixes the issue immediately:
Copy code
sql
GRANT USAGE, ALTER ON STORAGE VOLUME core_services_volume TO USER 'elastic_consumer'@'%';
Why this is required * 
CREATE TABLE
: Requires the 
USAGE
privilege on the storage volume specified in the 
PROPERTIES
. * 
SET DEFAULT STORAGE VOLUME
: Requires the 
ALTER
privilege on the specific storage volume. * 
DESC STORAGE VOLUME
: Also requires the 
USAGE
privilege on that volume. References • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/cluster-management/storage_volume/CREATE_STORAGE_VOLUME.md • sql-reference/sql-statements/account-management/GRANT.md References • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/account-management/GRANT.md • sql-reference/sql-statements/cluster-management/storage_volume/CREATE_STORAGE_VOLUME.md • sql-reference/sql-statements/cluster-management/storage_volume/DESC_STORAGE_VOLUME.md
m
@Rocky Does querying also need usage privilege on storage volume then?
r
No, querying (SELECT) does not require the 
USAGE
privilege on the storage volume. The 
USAGE
privilege on a 
STORAGE VOLUME
is a management and DDL-level permission. It is required for the following specific actions: * Describing the volume (
DESC STORAGE VOLUME
). * Creating a table or database that explicitly references that volume in its properties. * Setting a volume as the cluster's default volume. Why you don't need it for SELECT When a user runs a 
SELECT
query, StarRocks checks for: 1. 
USAGE
 on the Catalog. 2. 
USAGE
 on the Database. 3. 
SELECT
 on the Table. The interaction with the underlying remote storage (S3, etc.) is handled by the StarRocks engine using the credentials defined inside the storage volume object. The end-user does not need direct "usage" permission on the volume object just to read data from a table that is already built on top of it. Summary of Storage Volume Privileges Operation | Privilege Required 
SELECT * FROM table
| None (only Table/DB/Catalog privileges) 
CREATE TABLE ... PROPERTIES("storage_volume" = "...")
| 
USAGE
on the Storage Volume 
DESC STORAGE VOLUME <name>
| 
USAGE
on the Storage Volume 
SET <name> AS DEFAULT STORAGE VOLUME
| 
ALTER
on the Storage Volume 
CREATE STORAGE VOLUME
| 
CREATE STORAGE VOLUME
on SYSTEM References • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/cluster-management/storage_volume/DESC_STORAGE_VOLUME.md • sql-reference/sql-statements/cluster-management/storage_volume/CREATE_STORAGE_VOLUME.md References • administration/user_privs/authorization/privilege_item.md • sql-reference/sql-statements/cluster-management/storage_volume/DESC_STORAGE_VOLUME.md • sql-reference/sql-statements/cluster-management/storage_volume/CREATE_STORAGE_VOLUME.md • administration/user_privs/authorization/User_privilege.md • administration/user_privs/authorization/privilege_faq.md • sql-reference/sql-statements/account-management/GRANT.md
3 Views
Open in Slack
PreviousNext
Powered by