--- title: The Right Way to Give a Third-Party DBA Access to Your... description: Granting a third-party DBA superuser access to PostgreSQL is a common but risky shortcut. A safer approach is creating a dedicated, non-superuser role using... canonical: https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Right Way to Give a Third-Party DBA Access to Your PostgreSQL Database | daily.dev og:description: Granting a third-party DBA superuser access to PostgreSQL is a common but risky shortcut. A safer approach is creating a dedicated, non-superuser role using... og:url: https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55 og:image: https://api.daily.dev/og/posts/GwZaonG55.png og:image:alt: The Right Way to Give a Third-Party DBA Access to Your PostgreSQL Database og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Right Way to Give a Third-Party DBA Access to Your PostgreSQL Database **[Planet PostgreSQL](https://daily.dev/sources/planet-postgresql)** · 8 min read · 0 upvotes · 0 comments ## Summary Granting a third-party DBA superuser access to PostgreSQL is a common but risky shortcut. A safer approach is creating a dedicated, non-superuser role using PostgreSQL's predefined roles. The guide walks through creating a login role with no elevated flags, then layering in pg_monitor for observability, pg_signal_backend for session management, pg_checkpoint (PostgreSQL 15+) for manual checkpoints, and pg_maintain (PostgreSQL 17+) for running VACUUM/ANALYZE/REINDEX without data access. Verification steps are included, notably checking for PUBLIC grants that could silently expose data to the scoped role. The post also lists operations that still require superuser and should remain with internal teams. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What PostgreSQL role lets an external DBA run VACUUM or REINDEX on tables they don't own without giving them SELECT access? pg_maintain, introduced in PostgreSQL 17, allows a role to run VACUUM, ANALYZE, REINDEX, CLUSTER, and REFRESH MATERIALIZED VIEW on tables it does not own and has no SELECT privilege on. Before PostgreSQL 17, this required either table ownership or superuser, with no middle ground for delegating maintenance without granting data access. _Teams delegating database maintenance to outside contractors track role changes like pg_maintain on daily.dev._ ### How can I let an external DBA cancel long-running queries in PostgreSQL without giving them superuser access? Grant the pg_signal_backend predefined role, which lets a non-superuser role cancel runaway queries or terminate stuck sessions on other non-superusers' backends. It cannot terminate a superuser's own session, since PostgreSQL deliberately reserves that final kill switch for the internal DBA team, even when pg_signal_backend is granted to an external account. _Engineers scoping incident-response access for contractors reference role grants like this on daily.dev._ ### Which PostgreSQL role gives visibility into server performance and locks without exposing application table data? The pg_monitor predefined role grants visibility into server internals, active queries, lock waits, buffer stats, and replication lag without any access to application tables. It gives an external DBA everything needed for performance analysis and incident diagnosis while keeping tables like orders or users completely unreadable, preserving a clean security boundary. _Anyone designing least-privilege database access can compare predefined roles like this on daily.dev._ ## Similar posts on daily.dev - [Systemic Risks in the Managed PostgreSQL Industry - Mehmet Ince @mdisec - Vulnerability Researcher](https://daily.dev/posts/systemic-risks-in-the-managed-postgresql-industry---mehmet-ince-mdisec---vulnerability-researcher-0ic1zkpsb) · Planet PostgreSQL · 0 upvotes · 0 comments - [Postgres Monitoring for SQL Server DBAs: Statistics and Logs 101](https://daily.dev/posts/postgres-monitoring-for-sql-server-dbas-statistics-and-logs-101-am6ptsgaz) · pganalyze · 2 upvotes · 0 comments - [Why DBAs are right to be skeptical of AI — and where they’re wrong](https://daily.dev/posts/why-dbas-are-right-to-be-skeptical-of-ai-and-where-they-re-wrong-avo4ockmq) · InfoWorld · 0 upvotes · 1 comments - [Databases Were Not Designed For This](https://daily.dev/posts/databases-were-not-designed-for-this-ba5a1or8g) · Programming Digest · 32 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#database](https://daily.dev/tags/database), [#postgresql](https://daily.dev/tags/postgresql) [View this post on daily.dev](https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Right Way to Give a Third-Party DBA Access to Your PostgreSQL Database","url":"https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55"},"datePublished":"2026-07-23T16:04:16.590Z","dateModified":"2026-09-14T06:50:49.249Z","description":"Granting a third-party DBA superuser access to PostgreSQL is a common but risky shortcut. A safer approach is creating a dedicated, non-superuser role using...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Planet PostgreSQL","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Planet PostgreSQL","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/planet-postgresql"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,database,postgresql","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet PostgreSQL","item":"https://daily.dev/sources/planet-postgresql"},{"@type":"ListItem","position":3,"name":"The Right Way to Give a Third-Party DBA Access to Your PostgreSQL Database"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-right-way-to-give-a-third-party-dba-access-to-your-postgresql-database-gwzaong55#faq","mainEntity":[{"@type":"Question","name":"What PostgreSQL role lets an external DBA run VACUUM or REINDEX on tables they don't own without giving them SELECT access?","acceptedAnswer":{"@type":"Answer","text":"pg_maintain, introduced in PostgreSQL 17, allows a role to run VACUUM, ANALYZE, REINDEX, CLUSTER, and REFRESH MATERIALIZED VIEW on tables it does not own and has no SELECT privilege on. Before PostgreSQL 17, this required either table ownership or superuser, with no middle ground for delegating maintenance without granting data access. Teams delegating database maintenance to outside contractors track role changes like pg_maintain on daily.dev."}},{"@type":"Question","name":"How can I let an external DBA cancel long-running queries in PostgreSQL without giving them superuser access?","acceptedAnswer":{"@type":"Answer","text":"Grant the pg_signal_backend predefined role, which lets a non-superuser role cancel runaway queries or terminate stuck sessions on other non-superusers' backends. It cannot terminate a superuser's own session, since PostgreSQL deliberately reserves that final kill switch for the internal DBA team, even when pg_signal_backend is granted to an external account. Engineers scoping incident-response access for contractors reference role grants like this on daily.dev."}},{"@type":"Question","name":"Which PostgreSQL role gives visibility into server performance and locks without exposing application table data?","acceptedAnswer":{"@type":"Answer","text":"The pg_monitor predefined role grants visibility into server internals, active queries, lock waits, buffer stats, and replication lag without any access to application tables. It gives an external DBA everything needed for performance analysis and incident diagnosis while keeping tables like orders or users completely unreadable, preserving a clean security boundary. Anyone designing least-privilege database access can compare predefined roles like this on daily.dev."}}]} ```