Admin roles

pg_ba_admin

So that we can effectively manage the cloud resources and ensure users are protected against security threats, Cloud Service provides a special administrative role, pg_ba_admin. The edb_admin user is a member of the pg_ba_admin role. The pg_ba_admin role has privileges similar to a Postgres superuser. Like the edb_admin user, the pg_ba_admin role shouldn't be used for day-to-day application operations and access to the role must be controlled carefully. See pg_ba_admin role for details.

superuser

Superuser access in Cloud Service is available only where the users are in control of their infrastructure. When using your own cloud account, you can grant the edb_admin role superuser privileges for a cluster. See Superuser access.

When granting superuser privileges, to avoid degrading service or compromising availability, ensure you limit the number of connections used by superusers. Cloud Service reserves and requires a few superuser connections for the readiness probe for these reasons:

• To check if the database is up and able to accept connections
• For creating specific roles required in PostgreSQL instances and some extensions

For EDB Hosted Cloud Service and distributed high-availability clusters, there's no superuser access option. Use the edb_admin role for most superuser level activities. Unsafe activities aren't available to the edb_admin role.

Distributed high-availability clusters also have a bdr_superuser role. This isn't a general superuser but a specific user/role that has privileges and access to all the bdr schemas and functions. For more information, see bdr_superuser.

See the PostgreSQL documentation on superusers for best practices.

Notes on the edb_admin role

• Changes to system configuration (GUCs) made by edb_admin or other Postgres users don't persist through a reboot or maintenance. Use the Console to modify system configuration.

• You have to remember your edb_admin password, as EDB doesn't have access to it. If you forget it, you can set a new one in the Console on the Edit Cluster page.

• Don't use the edb_admin user or the edb_admin database in your applications. Instead, use CREATE USER; GRANT; CREATE DATABASE.

• Cloud Service stores all database-level authentication securely and directly in PostgreSQL. The edb_admin user password is SCRAM-SHA-256 hashed prior to storage. This hash, even if compromised, can't be replayed by an attacker to gain access to the system.