Database permissions
Minimum PostgreSQL and MySQL privileges for RDST Desktop, with optional grants for monitoring and Health Check.
RDST Desktop should connect with a dedicated read-only database user. The baseline account needs permission to connect, inspect the schema, and read the application tables you want RDST to analyze. Monitoring activity from other database users requires additional statistics privileges.
RDST Desktop does not run these GRANT statements for you. Ask a database
administrator to create the account, replace the example names, and limit it to
the databases and schemas you want RDST to inspect.
Permissions by feature
| Feature | PostgreSQL | MySQL |
|---|---|---|
| Connect and test credentials | CONNECT on the database | Permission to connect to the server |
| Schema, Analyze, Ask, and query execution | USAGE on each schema and SELECT on relevant tables and views | SELECT on the relevant database; SHOW VIEW when inspecting or explaining views |
| Realtime monitoring of this user's sessions | Baseline access | Baseline access |
| Realtime monitoring of all sessions | Membership in pg_read_all_stats | Global PROCESS |
| Historical slow queries | pg_stat_statements enabled, plus pg_read_all_stats to see other users' query text | Performance Schema enabled and SELECT on performance_schema.* |
| Health Check | Baseline access gives partial results; pg_monitor provides the most complete server-wide view | Baseline access gives partial results; PROCESS, Performance Schema access, and REPLICATION CLIENT provide more complete results |
Optional monitoring privileges expose query text and activity from other database users. Without them, RDST Desktop can still connect and analyze queries, but TOP and Health Check may show only RDST's sessions or incomplete historical data. Some checks return partial or empty results instead of an explicit permission error.
Create a read-only account
Run this as an administrator. Replace my_database, public, and
app_owner with your database, schema, and table-owning role.
CREATE ROLE rdst_readonly
LOGIN
PASSWORD 'replace_with_a_strong_password'
NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
GRANT CONNECT ON DATABASE my_database TO rdst_readonly;
-- Run these while connected to my_database.
GRANT USAGE ON SCHEMA public TO rdst_readonly;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO rdst_readonly;
-- Keep access when app_owner creates new tables.
ALTER DEFAULT PRIVILEGES FOR ROLE app_owner IN SCHEMA public
GRANT SELECT ON TABLES TO rdst_readonly;Repeat the schema grants for every application schema RDST should inspect.
Repeat ALTER DEFAULT PRIVILEGES for each role that creates tables.
For complete workload monitoring, add:
GRANT pg_read_all_stats TO rdst_readonly;For the most complete Health Check, grant pg_monitor instead. It includes
pg_read_all_stats, so you do not need to grant both.
GRANT pg_monitor TO rdst_readonly;Historical query monitoring also requires pg_stat_statements to be enabled
by a database administrator:
CREATE EXTENSION IF NOT EXISTS pg_stat_statements;PostgreSQL may require pg_stat_statements in shared_preload_libraries, a
server or managed-service setting rather than a user privilege.
Run this as an administrator. Replace my_database and the host pattern
with the narrowest values that match the RDST machine.
CREATE USER 'rdst_readonly'@'10.0.0.%'
IDENTIFIED BY 'replace_with_a_strong_password';
GRANT SELECT ON `my_database`.*
TO 'rdst_readonly'@'10.0.0.%';If RDST must inspect or explain views, add:
GRANT SHOW VIEW ON `my_database`.*
TO 'rdst_readonly'@'10.0.0.%';For complete realtime monitoring and Health Check, add:
GRANT PROCESS ON *.* TO 'rdst_readonly'@'10.0.0.%';
GRANT SELECT ON performance_schema.*
TO 'rdst_readonly'@'10.0.0.%';
GRANT REPLICATION CLIENT ON *.*
TO 'rdst_readonly'@'10.0.0.%';Performance Schema statement instrumentation and the statements_digest
consumer must also be enabled. Granting SELECT cannot enable collection.
If you explicitly use TOP's MySQL slow-log source, also grant
SELECT ON mysql.slow_log and configure slow_query_log=ON with
log_output=TABLE.
Verify the account in Desktop
- Open Connections.
- Add or edit the database connection.
- Enter the read-only account credentials.
- Select Save and check.
After the connection succeeds, open Queries and run Find slow queries to confirm that the optional monitoring privileges expose the workload you expect. An empty result can mean the account sees only its own sessions, the statistics extension is unavailable, or statement collection is disabled.
EXPLAIN ANALYZE executes the query while collecting its plan and timing.
Keep the account read-only and use fast or schema-only analysis when executing
a potentially expensive query is not appropriate.
Readyset caching uses different permissions
The grants above cover RDST Desktop diagnostics, analysis, and current shallow cache deployment. A deep Readyset deployment additionally snapshots tables and follows the replication stream, requiring broader upstream permissions and server configuration.
Use a separate deployment credential when possible. Do not add replication or administrative privileges to a diagnostics-only RDST account unless you are intentionally deploying deep caching.
Why least privilege matters
Database permissions are the final enforcement boundary. Audit direct,
inherited, default, PUBLIC, and routine-execution privileges: a role with no
direct table-write grant may still inherit broader access or invoke a
security-definer routine with side effects.
On MySQL, incomplete Performance Schema access can make unavailable index counters look like zeroes, potentially producing a false "unused index" finding. Confirm permissions and collection settings before acting on that recommendation.