> ## Documentation Index
> Fetch the complete documentation index at: https://astronomer.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Customer-created database users

This page covers the database setup required when you choose the *Customer manages users* model for [data plane failover](/docs/astro-private-cloud/v-2-x/data-plane-failover#per-deployment-database-users). In this model, you create the per-Deployment login roles yourself, and Astro Private Cloud (APC) still needs the privileges it uses to fence those roles during failover.

For the high-level overview and the alternative *APC manages users* model, see [Per-deployment database users](/docs/astro-private-cloud/v-2-x/data-plane-failover#per-deployment-database-users).

## Roles APC needs

For every Apache Airflow Deployment, APC requires the following on the Deployment's metadata database:

* An *owner role* on the metadata database, so APC can manage the schema and switch `CONNECT` privileges between the two login roles during failover.
* A *connection-terminator role* that can terminate active sessions for the two login roles, so APC can fence the source data plane during failover without needing full access to those login roles.
* *Membership* in both of these roles for the deployment orchestrator database user.

You create the two login roles per Deployment (one per data plane cluster) and grant them `CONNECT` on the metadata database.

## PostgreSQL example

For a Deployment whose metadata database is `airflow_db_<deployment>` and whose per-data-plane login roles are `dp1_user_<deployment>` and `dp2_user_<deployment>`, the full setup is:

```sql wrap theme={null}
CREATE ROLE airflow_db_<deployment>_owner NOLOGIN;
CREATE ROLE airflow_conn_killer_<deployment> NOLOGIN NOINHERIT;

ALTER DATABASE airflow_db_<deployment> OWNER TO airflow_db_<deployment>_owner;

REVOKE CONNECT ON DATABASE airflow_db_<deployment> FROM PUBLIC;
GRANT CONNECT ON DATABASE airflow_db_<deployment> TO dp1_user_<deployment>;
GRANT CONNECT ON DATABASE airflow_db_<deployment> TO dp2_user_<deployment>;

GRANT dp1_user_<deployment> TO airflow_conn_killer_<deployment> WITH INHERIT FALSE, SET FALSE;
GRANT dp2_user_<deployment> TO airflow_conn_killer_<deployment> WITH INHERIT FALSE, SET FALSE;

GRANT airflow_db_<deployment>_owner TO commander_user;
GRANT airflow_conn_killer_<deployment> TO commander_user;
```

Replace `commander_user` with the deployment orchestrator database user configured for your APC installation, and `<deployment>` with the identifier you use for each Airflow Deployment.

## Related documentation

* [Data plane failover](/docs/astro-private-cloud/v-2-x/data-plane-failover)
* [Enable data plane failover](/docs/astro-private-cloud/v-2-x/enable-data-plane-failover)
* [Trigger a data plane failover](/docs/astro-private-cloud/v-2-x/trigger-data-plane-failover)