I created a role with createrole flag, but users in this role trying to create users fail with permissions denied. Do I need to assign the createrole to each user instead of just the role (group)?

my steps were as follow:

create role group1 with nologin createrole;
create user user1 PASSWORD 'password' in role group1;

then login as user1 and trying to create user newuser fails with the error permission denied to create role

1 Answer 1


According to the docs, you have to use SET ROLE before actually using the createrole privilege.

Connect as user1 and issue

SET ROLE group1;
CREATE ROLE newuser;

Also, beware - CREATEROLE allows privilege escalation. This is also said in the docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.