ClickHouse/docs/en/operations/settings/permissions_for_queries.md

Permissions for queries

Queries in ClickHouse can be divided into several groups:

1. Read data queries: SELECT, SHOW, DESCRIBE, EXISTS.
2. Write data queries: INSERT, OPTIMIZE.
3. Change settings queries: SET, USE.
4. DDL queries: CREATE, ALTER, RENAME, ATTACH, DETACH, DROP TRUNCATE.
5. Particular queries: KILL QUERY.

The following settings regulate user permissions for the groups of queries:

• readonly — Restricts permissions for all groups of queries excepting DDL.
• allow_ddl — Restricts permissions for DDL queries.

KILL QUERY performs with any settings.

readonly

Restricts permissions for read data, write data and change settings queries.

See above for the division of queries into groups.

Possible values

• 0 — All queries are allowed. Default value.
• 1 — Read data queries only are allowed.
• 2 — Read data and change settings queries are allowed.

After setting readonly = 1, a user can't change readonly and allow_ddl settings in the current session.

When using the GET method in the HTTP interface, readonly = 1 is set automatically. To modify data use the POST method.

allow_ddl

Allows/denies DDL queries.

See above for the division of queries into groups.

Possible values

• 0 — DDL queries are not allowed.
• 1 — DDL queries are allowed. Default value.

You can not execute SET allow_ddl = 1 if allow_ddl = 0 for current session.

Original article