---
metadata:
  - name: generator
    content: Diplodoc Platform v5.50.6
alternate:
  - https://ydb.tech/docs/en/security/builtin-security.md
  - https://ydb.tech/docs/ru/security/builtin-security.md
sourcePath: en/core/security/builtin-security.md
---
> **Documentation Index:** Fetch the complete configuration index at https://ydb.tech/docs/en/llms.txt

# Initial cluster security configuration

Initial security is configured automatically when the YDB cluster starts for the first time.

During this process YDB adds a [superuser](#superuser) and a set of [roles](#roles) for user access management.

{% note info %}

For information about overriding and skipping initial security configuration, see the following sections:

- [Skipping initial security configuration](#skip-initial-security)
- [Overriding initial security configuration](#override-initial-security)

{% endnote %}

## Roles {#roles}

| Role              | Description |
|------------------|-------------|
| `ADMINS`        | Provides unlimited access rights for the entire YDB cluster scheme. |
| `DATABASE-ADMINS` | Provides access rights to manage databases, their scheme, and scheme access rights. No data access. |
| `ACCESS-ADMINS`  | Provides access rights to manage scheme access rights. No data access. |
| `DDL-ADMINS`    | Provides access rights to manage the scheme. No data access. |
| `DATA-WRITERS`  | Provides access rights for scheme objects, including reading and modifying data. |
| `DATA-READERS`  | Provides access rights for scheme objects and reading data. |
| `METADATA-READERS` | Provides access rights for scheme objects. No data access. |
| `USERS`         | Provides access rights for databases. This is a common group for all users. |

## Groups {#groups}

Roles in YDB are implemented as a hierarchy of [user](https://ydb.tech/docs/en/concepts/glossary.md#access-user) [groups](https://ydb.tech/docs/en/security/authorization.md#group) and a set of [access rights](https://ydb.tech/docs/en/security/authorization.md#right) for these groups. Access rights for the groups are granted on the cluster scheme root.

Groups can be nested, and a child group inherits the access rights of its parent group:

<!-- source: en/_includes/builtin-groups-graph.md -->
```mermaid
---
config:
  layout: elk
  elk:
    mergeEdges: true
    nodePlacementStrategy: NETWORK_SIMPLEX
---
graph BT

DATA-WRITERS & DATABASE-ADMINS --> ADMINS
DDL-ADMINS & ACCESS-ADMINS --> DATABASE-ADMINS
DATA-READERS --> DATA-WRITERS
METADATA-READERS --> DATA-READERS & DDL-ADMINS
%%USERS --> METADATA-READERS & DATA-READERS & DATA-WRITERS & DDL-ADMINS & ACCESS-ADMINS & DATABASE-ADMINS & ADMINS
USERS --> METADATA-READERS & DDL-ADMINS & ACCESS-ADMINS

    DATA-READERS["<b>DATA-READERS</b>
    +SelectRow"
    ]

    DATA-WRITERS["<b>DATA-WRITERS</b>
    +UpdateRow
    +EraseRow"
    ]

    METADATA-READERS["<b>METADATA-READERS</b>
    +DescribeSchema
    +ReadAttributes"
    ]

    DATABASE-ADMINS["<b>DATABASE-ADMINS</b>
    +CreateDatabase
    +DropDatabase"
    ]

    ACCESS-ADMINS["<b>ACCESS-ADMINS</b>
    +GrantAccessRights"
    ]

    DDL-ADMINS["<b>DDL-ADMINS</b>
    +CreateDirectory
    +CreateTable
    +CreateQueue
    +WriteAttributes
    +AlterSchema
    +RemoveSchema"
    ]

    USERS[<b>USERS</b>
    +ConnectDatabase
    ]
    ADMINS[<b>ADMINS</b>]
```

[//]: # (diplodoc support for mermaid lacks support for markdown in labels)
<!-- endsource: en/_includes/builtin-groups-graph.md -->

For example, users in the `DATA-WRITERS` group are allowed to:

- View the scheme — `METADATA-READERS`
- Read data — `DATA-READERS`
- Change data — `DATA-WRITERS`

Users in the `DDL-ADMINS` group are allowed to:

- View the scheme — `METADATA-READERS`
- Change the scheme — `DDL-ADMINS`

Users in the `ADMINS` group are allowed to perform all operations on the scheme and data.

## Superuser {#superuser}

A superuser belongs to the `ADMINS` and `USERS` groups and has full access rights to the cluster scheme.

By default, a superuser is the `root` user with an empty password.

## A group for all users {#all-users-group}

The `USERS` group is a common [group](https://ydb.tech/docs/en/concepts/glossary.md#access-group) for all local [users](https://ydb.tech/docs/en/concepts/glossary.md#access-user). When you [add new users](https://ydb.tech/docs/en/security/authorization.md#user), they are automatically added to the `USERS` group.

For more information about managing groups and users, see [Authorization](https://ydb.tech/docs/en/security/authorization.md).

## Overriding initial security configuration {#override-initial-security}

You can override the initial security configuration with a custom set of users, groups, and access rights.

To specify custom users, groups, and access rights to be created during the initial security configuration, define the `default_users`, `default_groups`, or `default_access` parameters in the [`security_config`](https://ydb.tech/docs/en/reference/configuration/security_config.md#security-bootstrap) section in the cluster configuration file.

## Skipping initial security configuration {#skip-initial-security}

You can skip initial security configuration by setting the [`security_config.disable_builtin_security`](https://ydb.tech/docs/en/reference/configuration/domains_config.md#domains-config) parameter to `true`.