Skip to content

Commit 86a97c2

Browse files
philerooskiphilerooski
authored
[SNOW-218] Create proxy admin database role (#131)
* Create proxy admin database role * Grant proxy admin role ownership of *ALL_ADMIN roles * Transfer ownership of current and future internamespace objects * address PR comments * bump version to avoid conflict * grant execute managed task privilege to proxy admin
1 parent 1e10d25 commit 86a97c2

8 files changed

+119
-0
lines changed

‎admin/future_grants/V1.6.4__internamespace_object_ownership_dev.sql

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-- Grant future ownership of object types which potentially need
2+
-- internamespace privileges to proxy admin database role.
3+
-- SYNAPSE
4+
GRANT OWNERSHIP
5+
ON FUTURE DYNAMIC TABLES
6+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
7+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN;
8+
9+
-- SYNAPSE_RAW
10+
GRANT OWNERSHIP
11+
ON FUTURE TASKS
12+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
13+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN;

‎admin/future_grants/V1.6.5__internamespace_object_ownership_prod.sql

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
-- Grant future ownership of object types which potentially need
2+
-- internamespace privileges to proxy admin database role.
3+
-- SYNAPSE
4+
GRANT OWNERSHIP
5+
ON FUTURE DYNAMIC TABLES
6+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
7+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN;
8+
9+
-- SYNAPSE_RAW
10+
GRANT OWNERSHIP
11+
ON FUTURE TASKS
12+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
13+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN;

‎admin/grants.sql

+10
Original file line numberDiff line numberDiff line change
@@ -633,3 +633,13 @@ GRANT USAGE
633633
GRANT SELECT, INSERT
634634
ON TABLE METADATA.SCHEMACHANGE.CHANGE_HISTORY
635635
TO ROLE SECURITYADMIN;
636+
637+
-- Allow the proxy admins to run serverless tasks
638+
USE ROLE ACCOUNTADMIN;
639+
GRANT EXECUTE MANAGED TASK
640+
ON ACCOUNT
641+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN;
642+
GRANT EXECUTE MANAGED TASK
643+
ON ACCOUNT
644+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN;
645+
USE ROLE SECURITYADMIN;

‎admin/ownership_grants/V1.6.0__proxy_admin_role_dev.sql

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-- Grant the proxy admin database role ownership and usage
2+
-- of the `*ALL_ADMIN` database roles.
3+
GRANT OWNERSHIP
4+
ON DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN
5+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN
6+
COPY CURRENT GRANTS;
7+
GRANT OWNERSHIP
8+
ON DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_ALL_ADMIN
9+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN
10+
COPY CURRENT GRANTS;
11+
GRANT OWNERSHIP
12+
ON DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE_ALL_ADMIN
13+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN
14+
COPY CURRENT GRANTS;
15+
16+
GRANT DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN
17+
TO ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN;
18+
GRANT DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_ALL_ADMIN
19+
TO ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN;
20+
GRANT DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE_ALL_ADMIN
21+
TO ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN;

‎admin/ownership_grants/V1.6.1__proxy_admin_role_prod.sql

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-- Grant the proxy admin database role ownership and usage
2+
-- of the `*ALL_ADMIN` database roles.
3+
GRANT OWNERSHIP
4+
ON DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_ALL_ADMIN
5+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN
6+
COPY CURRENT GRANTS;
7+
GRANT OWNERSHIP
8+
ON DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ADMIN
9+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN
10+
COPY CURRENT GRANTS;
11+
GRANT OWNERSHIP
12+
ON DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE_ALL_ADMIN
13+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN
14+
COPY CURRENT GRANTS;
15+
16+
GRANT DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_ALL_ADMIN
17+
TO ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN;
18+
GRANT DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ADMIN
19+
TO ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN;
20+
GRANT DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE_ALL_ADMIN
21+
TO ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN;

‎admin/ownership_grants/V1.6.2__internamespace_object_ownership_dev.sql

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-- Grant ownership of internamespace objects to proxy admin database role
2+
-- SYNAPSE
3+
GRANT OWNERSHIP
4+
ON ALL DYNAMIC TABLES
5+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
6+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN
7+
COPY CURRENT GRANTS;
8+
9+
-- SYNAPSE_RAW
10+
GRANT OWNERSHIP
11+
ON ALL TASKS
12+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
13+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.ALL_ADMIN
14+
COPY CURRENT GRANTS;

‎admin/ownership_grants/V1.6.3__internamespace_object_ownership_prod.sql

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-- Grant ownership of internamespace objects to proxy admin database role
2+
-- SYNAPSE
3+
GRANT OWNERSHIP
4+
ON ALL DYNAMIC TABLES
5+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
6+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN
7+
COPY CURRENT GRANTS;
8+
9+
-- SYNAPSE_RAW
10+
GRANT OWNERSHIP
11+
ON ALL TASKS
12+
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
13+
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.ALL_ADMIN
14+
COPY CURRENT GRANTS;

‎synapse_data_warehouse/database_roles/V2.39.0__proxy_admin_role.sql

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
USE DATABASE {{ database_name }}; --noqa: JJ01,PRS,TMP
2+
3+
-- Create proxy admin database role which will own the `*ALL_ADMIN` roles
4+
CREATE OR REPLACE DATABASE ROLE ALL_ADMIN;
5+
6+
-- Grant ownership of the proxy admin database role to the database admin
7+
GRANT OWNERSHIP
8+
ON DATABASE ROLE ALL_ADMIN
9+
TO ROLE {{ database_name }}_ADMIN; --noqa: JJ01,PRS,TMP
10+
11+
-- Grant proxy admin role to the database admin account role
12+
GRANT DATABASE ROLE ALL_ADMIN
13+
TO ROLE {{ database_name }}_ADMIN; --noqa: JJ01,PRS,TMP

0 commit comments

Comments
 (0)