Role-Based Access Control (RBAC) & Least Privilege

Database Privilege Model & Least Privilege

Enforce strict role segregation. Isolate analytical read-only users, application DML workers, and DBA administration accounts.

Filter by Engine:

PostgreSQL • Uygulama Kullanıcısı (App User)

Restricted strictly to DML operations (SELECT, INSERT, UPDATE, DELETE). DDL commands (DROP, ALTER), TRUNCATE, and schema ownership are denied.

İzin VerilenlerSELECT, INSERT, UPDATE, DELETE, EXECUTE

YasaklananlarDROP, ALTER, TRUNCATE, SUPERUSER, DBA

SQL Şablonu:

-- PostgreSQL Least-Privilege App User
REVOKE ALL ON SCHEMA public FROM PUBLIC;
CREATE ROLE app_user WITH LOGIN PASSWORD 'strong_scram_pass';
GRANT USAGE ON SCHEMA public TO app_user;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO app_user;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO app_user;

PostgreSQL • Raporlama & Analitik (Read-Only)

Read-only access with query timeout safeguards to prevent resource starvation on analytical reporting workloads.

İzin VerilenlerSELECT

YasaklananlarINSERT, UPDATE, DELETE, DDL, LOCK TABLE

SQL Şablonu:

-- Read-Only User with 30s Statement Timeout
CREATE ROLE bi_readonly WITH LOGIN PASSWORD 'strong_pass';
GRANT CONNECT ON DATABASE production_db TO bi_readonly;
GRANT USAGE ON SCHEMA public TO bi_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO bi_readonly;
ALTER ROLE bi_readonly SET statement_timeout = '30s';

MySQL • Uygulama Kullanıcısı (App User)

Strict DML privileges on the target database only. Global administrative privileges (SUPER, FILE, PROCESS) revoked.

İzin VerilenlerSELECT, INSERT, UPDATE, DELETE, EXECUTE

YasaklananlarDROP, ALTER, SUPER, FILE, GRANT OPTION

SQL Şablonu:

-- MySQL Least-Privilege App User
CREATE USER 'app_user'@'10.0.4.%' IDENTIFIED WITH caching_sha2_password BY 'StrongPassword123!';
GRANT SELECT, INSERT, UPDATE, DELETE, EXECUTE ON app_db.* TO 'app_user'@'10.0.4.%';
FLUSH PRIVILEGES;

SQL Server • Uygulama Kullanıcısı (App User)

Isolate server login and database user with db_datareader and db_datawriter roles. Strict denial of db_owner and sysadmin.

İzin Verilenlerdb_datareader (SELECT), db_datawriter (INSERT, UPDATE, DELETE)

YasaklananlarCONTROL SERVER, sysadmin, db_owner, db_ddladmin

SQL Şablonu:

-- SQL Server Least-Privilege App User
USE [master];
CREATE LOGIN [app_user] WITH PASSWORD = N'ComplexP@ssw0rd2026', CHECK_POLICY = ON;
USE [app_db];
CREATE USER [app_user] FOR LOGIN [app_user];
ALTER ROLE [db_datareader] ADD MEMBER [app_user];
ALTER ROLE [db_datawriter] ADD MEMBER [app_user];
DENY VIEW ANY DEFINITION TO [app_user];

SQL Server • Raporlama & Analitik (Read-Only)

Read-only analyst role with db_datareader and Resource Governor capping to prevent CPU starvation.

İzin Verilenlerdb_datareader (SELECT)

YasaklananlarINSERT, UPDATE, DELETE, DDL, db_datawriter, CONTROL

SQL Şablonu:

-- SQL Server Read-Only Reporting User
USE [master];
CREATE LOGIN [bi_readonly] WITH PASSWORD = N'ReadOnlyComplex#2026', CHECK_POLICY = ON;
USE [production_db];
CREATE USER [bi_readonly] FOR LOGIN [bi_readonly];
ALTER ROLE [db_datareader] ADD MEMBER [bi_readonly];
DENY ALTER TO [bi_readonly];