I have almost 20+ Databases each db contains lot of procedure trigger view etc, also have development windows user group, i have to give view and execute privilege to the group members. Also read,write,update,delete privilege to tables. How i can give all together ?
I am using SQL 2012
At a pure guess, and assuming the AD group already has a user on the database. You'll need to replace parts in the braces ({})
USE {Your Database};
GO
--create an executor role
CREATE ROLE db_executor;
GRANT EXECUTE TO db_executor;
GO
--Add AD group to roles.
ALTER ROLE db_datareader ADD MEMBER [{Your Domain}\{The AD Group}];
ALTER ROLE db_datawriter ADD MEMBER [{Your Domain}\{The AD Group}];
ALTER ROLE db_executor ADD MEMBER [{Your Domain}\{The AD Group}];
Related
Can we hide tables from users upon creation in Snowflake?
Can we setup an access control rule using wildcards on table names? Ex: revoke access to users if table name like '%ETL_TRANSIT%'?
OR
When creating a table/view, do we have an option to choose "not visible to users"?
You will first have to be using a different role to create the tables than the role that will be viewing the tables. I would recommend reviewing the Role-based Access Controls in the documentation: Role Hierarchy and Privilege Inheritance
I'm going to use SYSADMIN as the role that creates objects, and a create a new role for viewing called VIEWER just as an example. If you have SYSADMIN access you can test this out yourself:
USE ROLE sysadmin;
CREATE OR REPLACE DATABASE demo_db; -- creating a new db just for demo purposes
CREATE OR REPLACE SCHEMA demo_schema;
USE ROLE securityadmin; -- Use the securityadmin or useradmin to create and manage roles
CREATE ROLE viewer;
GRANT ROLE viewer TO ROLE sysadmin;
-- Now go check out the Roles page in Snowsight under Admin --> Users & Roles
-- You should see viewer underneath sysadmin
USE ROLE viewer; -- You will see nothing because you don't have access to anything
USE ROLE securityadmin;
GRANT USAGE ON WAREHOUSE compute_wh TO ROLE viewer; -- viewer needs a WH to access data
GRANT USAGE ON DATABASE demo_db TO ROLE viewer;
GRANT USAGE ON SCHEMA demo_db.demo_schema TO ROLE viewer;
USE ROLE viewer; -- You will see the db and the schema now
-- Follow this for each new table you create:
USE ROLE sysadmin;
CREATE OR REPLACE TABLE demo_db.demo_schema.demo_tbl (col INT);
USE ROLE viewer; -- You will not see the new table
USE ROLE securityadmin;
GRANT SELECT ON demo_db.demo_schema.demo_tbl TO ROLE viewer;
USE ROLE viewer; -- You will now see the new table and be able to query it
Do NOT grant SELECT on FUTURE TABLES or FUTURE VIEWS in a schema though. IF you do that, the Viewer role will automatically see new tables as you create them. You will want to grant SELECT one at a time based on your requirements.
This is an answer to your second requirement. You could build out a Stored Procedure that could GRANT based on a like, but it would be a highly custom option that would need to run on a schedule or triggered manually.
Unless you have future grants in place or a role is inheriting the role used to create the table, most roles do not automatically gain access to tables created by other roles. You would need to explicitly grant them permissions on the new table (and the table's associated schema/database) in order for the table to be "visible" to the role.
how to perform joins and how to maintain warehouse?
I have tried:
create table table_name values i int, nm string;
How to create a role in snowflake without any privileges or minimum privileges ?
I tried to create a role with parent role security-admin .
when I assign this role to user i am able to see databases of parent role also.
After I created role with parent role as public still I am able to see databases
what shall I do that a created role should not have access to any unless I grant it ?
When you CREATE ROLE, it's an independent object and does not come with any privileges:
use role accountadmin;
create role empty_role;
show grants to role empty_role;
The last command does not return anything even if it is created by the accountadmin role.
grant role empty_role to user gokhan;
use role empty_role;
show databases;
As the new role has no additional access, the last command shows the databases which the PUBLIC role has access. I hope this explains why you see some databases when you switch to your new role.
For example: if user named Henry123 belongs to group h1234 i.e., LOGON\h1234\Henry123', we should revoke db_datareader role from Henry123 user but shouldn't drop user from the h1234 group.
What's the way to do it from SQL Server database?
I am new to SQL Server. Kindly provide a solution to this problem.
If the role has been given to the group and you want to remove the privilege done by a role to a member of the group without removing this user from the group, you must use the DENY command.
In your case :
DENY SELECT TO Henry123;
I'm gIven the problem:
Write a script that creates a user-defined role named VendorMaintenance in the AP database. Give update permissions to that role on the Vendors table and Select permission on the Invoice and InvoiceLineItems table. Assign the VendorMaintenance role to dbMaster.
I've looked through my textbook and came up with this incorrect solution.
USE AP
GO
CREATE SERVER ROLE VendorMaintenance
GO
GRANT UPDATE
ON Vendors
TO VendorMaintenance
GO
GRANT SELECT
ON Invoices
TO VendorMaintenance
GO
GRANT SELECT
ON InvoiceLineItems
TO VendorMaintenance
GO
ALTER SERVER ROLE VendorMaintenance ADD MEMBER dbMaster
GO
It says that VendorMaintenance isn't a user, and its not. but I need to grant these permissions to the role and then assign users to that role. Also is there a better way to write this?
For a user-defined database role, the syntax is as below. The role will be created in the current database context.
USE AP;
GO
CREATE ROLE VendorMaintenance;
GO
CREATE SERVER ROLE creates a user-defined server role, which is used to grant server-scoped permissions rather than permissions on database-scoped objects.
I'm not the member of db_datareader database role but still I'm able to do select operation on tables. In which scenario it is required to add users to this role?
How is it possible to do select operations without being the member of db_datareader?
If you are a member of another role with select granted for the object, you can do the select. db_datareader is a fixed role that bypasses select grants (you cannot revoke select for a user with db_datareader).