# The Role object

Role represents a Postgres role within a Branch.

## Attributes

- `name` (string)
  Output only. The full resource path of the role.
   Format: projects/{project_id}/branches/{branch_id}/roles/{role_id}
- `parent` (string)
  The Branch where this Role exists.
   Format: projects/{project_id}/branches/{branch_id}
- `create_time` (string)
- `update_time` (string)
- `spec` (object)
  The spec contains the role configuration, including identity type, authentication method, and role attributes.
  - `membership_roles` (array of string)
    An enum value for a standard role that this role is a member of.
    Possible values: `MEMBERSHIP_ROLE_UNSPECIFIED`, `DATABRICKS_SUPERUSER`
  - `identity_type` (string)
    The type of role.
     When specifying a managed-identity, the chosen role_id must be a valid:
    
      * application ID for SERVICE_PRINCIPAL
      * user email for USER
      * group name for GROUP
    Possible values: `IDENTITY_TYPE_UNSPECIFIED`, `USER`, `SERVICE_PRINCIPAL`, `GROUP`
  - `attributes` (object)
    The desired API-exposed Postgres role attribute to associate with the role. Optional.
    - `createdb` (boolean)
    - `createrole` (boolean)
    - `bypassrls` (boolean)
  - `auth_method` (string)
    Controls how the Postgres role authenticates when a client opens a database
     connection. Supported values:
    
      * LAKEBASE_OAUTH_V1: the role authenticates by presenting a Databricks
        OAuth access token derived from the backing managed identity (the
        <Databricks> user, service principal, or group named by the role's
        `postgres_role`). No static password exists for roles using this method.
      * PG_PASSWORD_SCRAM_SHA_256: the role authenticates with a Postgres
        password verified server-side using the SCRAM-SHA-256 mechanism.
        Lakebase generates a password for the role.
      * NO_LOGIN: the role cannot open a Postgres session at all. Useful for
        roles that exist only to own objects or to aggregate privileges that
        are then granted to other, loginable roles.
    
     If auth_method is left unspecified, a meaningful authentication method is derived from the identity_type:
      * For the managed identities, OAUTH is used.
      * For the regular postgres roles, authentication based on postgres passwords is used.
    
     NOTE: for the <Databricks> identity type GROUP, LAKEBASE_OAUTH_V1
     is the default auth method (group can login as well).
    Possible values: `AUTH_METHOD_UNSPECIFIED`, `NO_LOGIN`, `PG_PASSWORD_SCRAM_SHA_256`, `LAKEBASE_OAUTH_V1`
  - `postgres_role` (string)
    The name of the Postgres role.
    
     This expects a valid Postgres identifier as specified in the link below.
     https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS
    
     Required when creating the Role.
    
     If you wish to create a Postgres Role backed by a managed <Databricks> identity, then postgres_role
     must be one of the following:
    
        1. user email for IdentityType.USER
        2. app ID for IdentityType.SERVICE_PRINCIPAL
        2. group name for IdentityType.GROUP
- `status` (object)
  Current status of the role, including its identity type, authentication method, and role attributes.
  - `membership_roles` (array of string)
    An enum value for a standard role that this role is a member of.
    Possible values: `MEMBERSHIP_ROLE_UNSPECIFIED`, `DATABRICKS_SUPERUSER`
  - `identity_type` (string)
    The type of the role.
    Possible values: `IDENTITY_TYPE_UNSPECIFIED`, `USER`, `SERVICE_PRINCIPAL`, `GROUP`
  - `attributes` (object)
    The PG role attributes associated with the role.
    - `createdb` (boolean)
    - `createrole` (boolean)
    - `bypassrls` (boolean)
  - `auth_method` (string)
    Possible values: `AUTH_METHOD_UNSPECIFIED`, `NO_LOGIN`, `PG_PASSWORD_SCRAM_SHA_256`, `LAKEBASE_OAUTH_V1`
  - `postgres_role` (string)
    The name of the Postgres role.
  - `role_id` (string)
    Part of the resource name.
- `role_id` (string)
  The part of the name, chosen by the user when the resource was created.

## Example

```json
{
  "name": "string",
  "parent": "string",
  "create_time": "string",
  "update_time": "string",
  "spec": {
    "membership_roles": [
      "string"
    ],
    "identity_type": "string",
    "attributes": {},
    "auth_method": "string",
    "postgres_role": "string"
  },
  "status": {
    "membership_roles": [
      "string"
    ],
    "identity_type": "string",
    "attributes": {},
    "auth_method": "string",
    "postgres_role": "string",
    "role_id": "string"
  },
  "role_id": "string"
}
```