ALTER GROUP reference

Enterprise—

RBAC provides fine-grained database permissions management.

Learn more

ALTER GROUP modifies group settings.

For full documentation of the Access Control List and Role-based Access Control, see the RBAC operations page.

Syntax​

Set or clear memory limit
ALTER GROUP groupName SET MEMORY LIMIT { size | UNLIMITED };
Add or remove external alias
ALTER GROUP groupName { WITH | DROP } EXTERNAL ALIAS externalAlias;

Description​

  • ALTER GROUP groupName SET MEMORY LIMIT size - caps the native memory that queries of the group's members may allocate. size is a byte count or a size with a K, M, or G suffix, such as 512M or 2G.
  • ALTER GROUP groupName SET MEMORY LIMIT UNLIMITED - removes the limit. SET MEMORY LIMIT 0 does the same.
  • ALTER GROUP groupName WITH EXTERNAL ALIAS externalAlias - maps an external OIDC or LDAP group to this group.
  • ALTER GROUP groupName DROP EXTERNAL ALIAS externalAlias - removes an external group mapping.

A member's queries run under the smallest positive memory limit among the user's own limit and the limits of every group they belong to, capped further at the configured cairo.query.memory.limit.bytes workload limit. Setting a group limit requires the SET MEMORY LIMIT permission. See memory limits for how per-principal and workload limits combine.

For external group mapping with OIDC or LDAP, see the OpenID Connect (OIDC) integration guide.

Examples​

Set memory limit​

-- cap queries of the group's members at 2 GiB of native memory
ALTER GROUP analysts SET MEMORY LIMIT 2G;
-- remove the limit
ALTER GROUP analysts SET MEMORY LIMIT UNLIMITED;

The configured value can be verified with SHOW GROUPS, which reports it in the memory_limit column.

Map an external group​

ALTER GROUP analysts WITH EXTERNAL ALIAS 'CN=Analysts,OU=Users,DC=example,DC=com';
ALTER GROUP analysts DROP EXTERNAL ALIAS 'CN=Analysts,OU=Users,DC=example,DC=com';