What Permissions Are Required to Create and Use a Database?
Published:
In order to create a database, the server requires specific permissions to be assigned to your username. Please refer to this documentation to understand which permissions are needed to enable Bold BI to connect to and utilize the database.
The credentials provided to connect to the server instance must have the following permissions:
- Create Database: Permission is granted to create databases if the application is to be deployed on a new database.
- Create Table: Permission is required to create tables for the applications.
- Insert: Permission is granted to add new records to the tables.
- Update: Permission is granted to update existing records in the tables.
- Alter: Permission is granted to change the database schema during upgrades.
- Select: Permission is granted to read the records from the tables.
- Drop Table: Permission is granted to change the database schema during upgrades and to remove tables from the database when deleting the site.
- Drop Database: Permission to drop the database is granted while deleting the site.
Additional Permission need for the Shared Database:
- Security Admin: Additionally, in a shared database environment, the “securityadmin” server role is temporarily required during the initial Bold BI deployment.
Find the actions that require “SecurityAdmin” Role below here: The following operations cannot be performed with just db_owner or public roles:
1. Creating SQL Server logins
- Required to authenticate Bold BI users at the server level
- CREATE LOGIN requires “securityadmin”
2. Mapping logins to database users
- CREATE USER links the login to the database
- Needed to apply RLS policies correctly
3. Assigning roles like db_datareader and db_datawriter
- Ensures the new user has only the necessary access to read/write data
- Helps enforce least privilege access
Why This Matters for RLS:
- RLS policies are user-context sensitive.
- Admin or system users (like dbo) can bypass RLS filters, which may lead to data leakage or policy violations.
- A dedicated user with only the required roles ensures:
RLS is applied correctly
No interference with other applications or users in the shared Database.
Security Assurance
- Temporary Access: The ‘securityadmin’ role is required solely during the deployment phase.
- Post-Deployment Cleanup: Bold BI does not automatically revoke this permission upon completion of the setup. Therefore, it is recommended to manually remove the ‘securityadmin’ role after the deployment process has been finalized.
- Note: After completing the deployment, we manually revoked the permission and verified that Bold BI functions correctly.
References
NG
