Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SNOW-200] Create analyst database roles #107

Merged
merged 3 commits into from
Feb 3, 2025
Merged

[SNOW-200] Create analyst database roles #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
57a9e77
Create data warehouse analyst database roles
philerooski Jan 23, 2025
67ed320
grant read privileges to data warehouse analyst roles
philerooski Jan 24, 2025
553584a
grant future read privileges to analyst roles
philerooski Jan 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 93 additions & 0 deletions admin/future_grants/V1.3.0__data_warehouse_analyst_read.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
---- SYNAPSE_DATA_WAREHOUSE ----
-- SYNAPSE
GRANT SELECT, REFERENCES
ON FUTURE TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_TABLE_READ;
GRANT SELECT, MONITOR
ON FUTURE DYNAMIC TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_TABLE_READ;
GRANT USAGE, READ
ON FUTURE STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_STAGE_READ;
GRANT SELECT, REFERENCES
ON FUTURE VIEWS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_VIEW_READ;
GRANT MONITOR
ON FUTURE TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_TASK_READ;

-- SYNAPSE_RAW
GRANT SELECT, REFERENCES
ON FUTURE TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_TABLE_READ;
GRANT USAGE, READ
ON FUTURE STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_STAGE_READ;
GRANT SELECT
ON FUTURE STREAMS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_STREAM_READ;
GRANT MONITOR
ON FUTURE TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_TASK_READ;

-- SCHEMACHANGE
GRANT SELECT, REFERENCES
ON FUTURE TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE_TABLE_READ;

---- SYNAPSE_DATA_WAREHOUSE_DEV ----
-- SYNAPSE
GRANT SELECT, REFERENCES
ON FUTURE TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_TABLE_READ;
GRANT SELECT, MONITOR
ON FUTURE DYNAMIC TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_TABLE_READ;
GRANT USAGE, READ
ON FUTURE STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_STAGE_READ;
GRANT SELECT, REFERENCES
ON FUTURE VIEWS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_VIEW_READ;
GRANT MONITOR
ON FUTURE TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_TASK_READ;

-- SYNAPSE_RAW
GRANT SELECT, REFERENCES
ON FUTURE TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_TABLE_READ;
GRANT USAGE, READ
ON FUTURE STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_STAGE_READ;
GRANT SELECT
ON FUTURE STREAMS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_STREAM_READ;
GRANT MONITOR
ON FUTURE TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_TASK_READ;

-- SCHEMACHANGE
GRANT SELECT, REFERENCES
ON FUTURE TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE_TABLE_READ;
122 changes: 122 additions & 0 deletions admin/grants.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -505,6 +505,128 @@ GRANT ROLE SYNAPSE_DATA_WAREHOUSE_ANALYST TO ROLE SYNAPSE_DATA_WAREHOUSE_ADMIN;
GRANT ROLE SYNAPSE_DATA_WAREHOUSE_DEV_ADMIN TO ROLE SYSADMIN;
GRANT ROLE SYNAPSE_DATA_WAREHOUSE_DEV_ANALYST TO ROLE SYNAPSE_DATA_WAREHOUSE_DEV_ADMIN;

---- RBAC reconfiguration of data warehouse ----
-- The following grants provide read access on most
-- objects presently within the data warehouse.

---- SYNAPSE_DATA_WAREHOUSE ----
-- Grant the aggregate roles usage on their respective schema
GRANT USAGE, MONITOR
ON SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_ALL_ANALYST;
GRANT USAGE, MONITOR
ON SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ANALYST;
GRANT USAGE, MONITOR
ON SCHEMA SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE_ALL_ANALYST;

-- Grant object-type-specific privileges to the appropriate object-type-specific role
-- SYNAPSE
GRANT SELECT, REFERENCES
ON ALL TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_TABLE_READ;
GRANT SELECT, MONITOR
ON ALL DYNAMIC TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_TABLE_READ;
GRANT USAGE, READ
ON ALL STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_STAGE_READ;
GRANT SELECT, REFERENCES
ON ALL VIEWS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_VIEW_READ;
GRANT MONITOR
ON ALL TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_TASK_READ;

-- SYNAPSE_RAW
GRANT SELECT, REFERENCES
ON ALL TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_TABLE_READ;
GRANT USAGE, READ
ON ALL STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_STAGE_READ;
GRANT SELECT
ON ALL STREAMS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_STREAM_READ;
GRANT MONITOR
ON ALL TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_TASK_READ;

-- SCHEMACHANGE
GRANT SELECT, REFERENCES
ON ALL TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SCHEMACHANGE_TABLE_READ;

---- SYNAPSE_DATA_WAREHOUSE_DEV ----
-- Grant the aggregate roles usage on their respective schema
GRANT USAGE, MONITOR
ON SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ANALYST;
GRANT USAGE, MONITOR
ON SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_ALL_ANALYST;
GRANT USAGE, MONITOR
ON SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE_ALL_ANALYST;

-- Grant object-type-specific privileges to the appropriate object-type-specific role
-- SYNAPSE
GRANT SELECT, REFERENCES
ON ALL TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_TABLE_READ;
GRANT SELECT, MONITOR
ON ALL DYNAMIC TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_TABLE_READ;
GRANT USAGE, READ
ON ALL STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_STAGE_READ;
GRANT SELECT, REFERENCES
ON ALL VIEWS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_VIEW_READ;
GRANT MONITOR
ON ALL TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_TASK_READ;

-- SYNAPSE_RAW
GRANT SELECT, REFERENCES
ON ALL TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_TABLE_READ;
GRANT USAGE, READ
ON ALL STAGES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_STAGE_READ;
GRANT SELECT
ON ALL STREAMS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_STREAM_READ;
GRANT MONITOR
ON ALL TASKS
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_TASK_READ;

-- SCHEMACHANGE
GRANT SELECT, REFERENCES
ON ALL TABLES
IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE
TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SCHEMACHANGE_TABLE_READ;

-- Allow SECURITYADMIN to deploy schemachange for versioned admin scripts
GRANT USAGE
ON DATABASE METADATA
Expand Down
96 changes: 96 additions & 0 deletions synapse_data_warehouse/database_roles/V2.33.0__database_analyst_roles.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,96 @@
USE DATABASE {{ database_name }}; --noqa: JJ01,PRS,TMP
Copy link
Collaborator Author

@philerooski philerooski Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Our initial state after #104 is merged. The diagrams are database-agnostic (dev/prod).
SNOW-200


-- Create roles which will aggregate the object-type-specific roles
CREATE OR REPLACE DATABASE ROLE SYNAPSE_ALL_ANALYST;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST;
CREATE OR REPLACE DATABASE ROLE SCHEMACHANGE_ALL_ANALYST;

-- Grant ownership of the analyst aggregate roles to their
-- respective admin aggregate role
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_ALL_ANALYST
TO ROLE SYNAPSE_ALL_ADMIN; --noqa: JJ01,PRS,TMP
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST
TO ROLE SYNAPSE_RAW_ALL_ADMIN; --noqa: JJ01,PRS,TMP
GRANT OWNERSHIP
ON DATABASE ROLE SCHEMACHANGE_ALL_ANALYST
TO ROLE SCHEMACHANGE_ALL_ADMIN; --noqa: JJ01,PRS,TMP

-- Grant analyst aggregate roles to the database analyst account role
GRANT DATABASE ROLE SYNAPSE_ALL_ANALYST
TO ROLE {{ database_name }}_ANALYST; --noqa: JJ01,PRS,TMP
GRANT DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST
TO ROLE {{ database_name }}_ANALYST; --noqa: JJ01,PRS,TMP
GRANT DATABASE ROLE SCHEMACHANGE_ALL_ANALYST
TO ROLE {{ database_name }}_ANALYST; --noqa: JJ01,PRS,TMP
Copy link
Collaborator Author

@philerooski philerooski Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SNOW-200 (1)



-- Create object-type-specific roles, grant ownership of each to
-- their respective admin aggregate role, and grant each to the
-- respective analyst aggregate role
-- SYNAPSE
CREATE OR REPLACE DATABASE ROLE SYNAPSE_TABLE_READ;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_STAGE_READ;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_VIEW_READ;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_TASK_READ;

GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_TABLE_READ
TO DATABASE ROLE SYNAPSE_ALL_ADMIN;
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_STAGE_READ
TO DATABASE ROLE SYNAPSE_ALL_ADMIN;
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_VIEW_READ
TO DATABASE ROLE SYNAPSE_ALL_ADMIN;
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_TASK_READ
TO DATABASE ROLE SYNAPSE_ALL_ADMIN;

GRANT DATABASE ROLE SYNAPSE_TABLE_READ
TO DATABASE ROLE SYNAPSE_ALL_ANALYST;
GRANT DATABASE ROLE SYNAPSE_STAGE_READ
TO DATABASE ROLE SYNAPSE_ALL_ANALYST;
GRANT DATABASE ROLE SYNAPSE_VIEW_READ
TO DATABASE ROLE SYNAPSE_ALL_ANALYST;
GRANT DATABASE ROLE SYNAPSE_TASK_READ
TO DATABASE ROLE SYNAPSE_ALL_ANALYST;
Copy link
Collaborator Author

@philerooski philerooski Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SNOW-200 (2)


-- SYNAPSE_RAW
CREATE OR REPLACE DATABASE ROLE SYNAPSE_RAW_TABLE_READ;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_RAW_STAGE_READ;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_RAW_STREAM_READ;
CREATE OR REPLACE DATABASE ROLE SYNAPSE_RAW_TASK_READ;

GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_RAW_TABLE_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ADMIN;
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_RAW_STAGE_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ADMIN;
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_RAW_STREAM_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ADMIN;
GRANT OWNERSHIP
ON DATABASE ROLE SYNAPSE_RAW_TASK_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ADMIN;

GRANT DATABASE ROLE SYNAPSE_RAW_TABLE_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST;
GRANT DATABASE ROLE SYNAPSE_RAW_STAGE_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST;
GRANT DATABASE ROLE SYNAPSE_RAW_STREAM_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST;
GRANT DATABASE ROLE SYNAPSE_RAW_TASK_READ
TO DATABASE ROLE SYNAPSE_RAW_ALL_ANALYST;
Copy link
Collaborator Author

@philerooski philerooski Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SNOW-200 (3)


-- SCHEMACHANGE
CREATE OR REPLACE DATABASE ROLE SCHEMACHANGE_TABLE_READ;

GRANT OWNERSHIP
ON DATABASE ROLE SCHEMACHANGE_TABLE_READ
TO DATABASE ROLE SCHEMACHANGE_ALL_ADMIN;

GRANT DATABASE ROLE SCHEMACHANGE_TABLE_READ
TO DATABASE ROLE SCHEMACHANGE_ALL_ANALYST;
Copy link
Collaborator Author

@philerooski philerooski Jan 23, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is our final state.
SNOW-200 (4)

Copy link
Member

@thomasyu888 thomasyu888 Jan 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The diagrams showing the transitions are super helpful and I think the final state should be included in documentation (once final review) so that people have an easier time when onboarding and learning about this.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added the diagram here. Turns out I already had some verbiage which said that all objects, including database roles, ought to be owned by the appropriate *ALL_ADMIN database role. But the diagram definitely makes it clearer.