Amazon RDS for Db2 default roles
When RDS for Db2 provisions a database (rdsadmin.create_database) or restores one (rdsadmin.restore_database), it
creates a set of default principals: users, groups, and roles. RDS for Db2 grants its managed
roles to master_user_role with the ADMIN option, and grants
master_user_role to the master user. The master user can then grant
these roles to other users, groups, or roles by using standard GRANT statements.
The following table lists each principal and the role or privileges it receives.
| Principal | Type | Receives (role or privilege) |
|---|---|---|
MASTER_USER_ROLE |
Role | See the system privilege and database role columns for RDS for Db2 in Master user account privileges. |
MASTER USER (ADMIN) |
User (master) | MASTER_USER_ROLE |
MASTERDBA |
Group | MASTER_USER_ROLE |
DBA |
Role | DATAACCESS. The master user can add more authorizations
or privileges to this role, and then grant the role to other users,
groups, or roles. |
DBA_RESTRICTED |
Role | Empty role. The master user can add privileges to this role, and then grant the role to other users, groups, or roles. |
DEVELOPER |
Role | DATAACCESS. The master user can add more authorizations
or privileges to this role, and then grant the role to other users,
groups, or roles. |
ROLE_NULLID_PACKAGES |
Role | BIND and EXECUTE on NULLID.*
system packages. |
ROLE_PROCEDURES |
Role | EXECUTE on selected SYSIBM/SYSPROC
procedures. |
ROLE_TABLESPACES |
Role | USE OF TABLESPACE on tablespaces created by
RDS for Db2. |
