Manage ClickHouse® users

In this article, you'll learn how to:

Before you start

Make sure you have the ClickHouse® client installed.

Connect to your cluster with a connection string:

Go to the Clusters page in the console.
Under Connection strings, find the Native interface string and click Copy.

Open your terminal and run a command to connect to your cluster:

Docker

Native clickhouse-client

docker run --network host --rm -it clickhouse/<Native interface connection string>

The complete Docker command structure

docker run --network host --rm -it \ 
            clickhouse/clickhouse-client \
            --host <FQDN of your cluster> \
            --secure \
            --user <cluster user name> \
            --password <cluster user password> \
            --port 9440

<Native interface connection string>

Use named collections

If you don't want to expose your credentials when accessing your data with the S3 engine, you can use named collections .

To create a named collection, use an admin account to send the following via a ClickHouse® query:

Collection name
AWS key
AWS secret key
Path to your Amazon S3 bucket.

For example:

CREATE NAMED COLLECTION s3_demo AS
access_key_id = 'AWS KEY',
secret_access_key = 'AWS SECRET KEY',
url = 'https://<bucket-name>.s3.eu-central-1.amazonaws.com/';

Now you can access your Amazon S3 data without having to expose the credentials:

SELECT *
FROM s3(s3_demo, filename = 'weather_json/sensors.2021.json.gz', format = 'JSONEachRow', structure = 'snowfall Nullable(String)')
LIMIT 2

Create a ClickHouse® user for the Viewer role

The Viewer role doesn't allow access to connection strings of your Managed ClickHouse® clusters. If you want to provide access to a cluster, create a standalone user with read-only rights for each Managed ClickHouse® cluster on your project:

Create a user and its password:

CREATE USER IF NOT EXISTS <new_user_name> ON CLUSTER <cluster ID> IDENTIFIED BY '<new_user_password>'

Assign the read-only rights to the newly created user:
```
GRANT SHOW TABLES, SELECT ON database.* TO <new_user_name>
```
Now the user can see the tables and perform SELECT queries with all the databases on the cluster.

The newly created user can connect to the cluster with the following string:

clickhouse-client --host <FQDN of the cluster where you created this user> \
                  --secure \
                  --user <new_user_name> \
                  --password <new_user_password> \
                  --port 9440

Delete a ClickHouse® user

To delete a user from your ClickHouse® cluster, send the following query:

DROP USER <user_name>

Manage ClickHouse® users

Before you start

Use named collections

Create a ClickHouse® user for the Viewer role

Delete a ClickHouse® user

See also