I have created several logins in a SQL Server RDS instance, using the RDS 'master' user to create the logins. The logins have permissions to create databases. However, these new databases are inaccessible to the RDS 'master' user. I receive messages such as:
The database xxxxx is not accessible (ObjectExplorer)
and
The server principal "rdsmaster" is not able to access the database "xxxxx" under the current security context.
In order for the RDS master login to have access to these databases, is the only option to have the login that created the database explicitly grant permissions to the new DB? Or, is there a master switch somewhere that will grant the master login permissions for each new database created, regardless of who created it? e.g. parameter group, sql role?
I need the master user, or at least a "clone" of the master user, to access all databases for things like index maintenance jobs, backups to S3, etc.
Many thanks,
Andrew
Resetting the master user password in the RDS console worked for me.
Found the solution mentioned in these threads:
Master user lost it's permissions unexpectedly on SQL Server (rds instance)
Granting Access to Database RDS SQL Server
Related
Restating my question: I have an SQL server for a client that has development and production databases on it. The client wants their admin to be able to create users and logins to one of the databases, but not give their admin ability to give users access to the other database. I realize that users are created at the database level and logins at the server level, so am not sure what permissions this would mean the admin have to have. How can they create logins (sql server admin?)yet only be able to create users in one database?
I need to create a login on a server that will have access to all databases on this server.
I have two azure servers: production and stage. I make a copy of a database from prod server on stage server. Then I need to do insert some test data in this new copied database.
The copying process is made on runbooks in azure automation account so every time I want to execute SQL script on a database I need to provide a login&password to a server.
If I create a login TestLogin on stage server and then copy database from prod server to stage, then this login does not have access to a new db. Thus, I need to login as administrator and create a TestUser in this new database for TestLogin.
This does not work for Azure:
GRANT CONTROL SERVER TO TestLogin;
Is there any way I can grant a TestLogin all rights so that it can have access to all the databases on server?
When you create a login in one instance of SQL Server and assign any roles to this user on a specific database, and then copy the database to another SQL Server instance, you have this user in the database, but no login for that user in the second SQL Server. This is also called an "orphaned user". Here is an article that describes how to fix that.
This does not work on Azure. You have to use ALTER USER instead.
As you said in comment, you must login with admin, then you have the permission to alter the new user in master DB, set the user as DB manager or db_owner.
If you only create new login or user and don't give it more permission, this login/user only and login the Database but can't access no database.
Fore details, please see Controlling and granting database access to SQL Database and SQL Data Warehouse.
Hope this helps.
I'm using the Telegraf input plugin for SQL Server (https://github.com/influxdata/telegraf/tree/master/plugins/inputs/sqlserver) to gather metrics and report to InfluxDB. It works well for SQL Server, but though it supports Azure SQL Database the documentation is a bit sparse.
The database user should be created like this:
CREATE LOGIN [telegraf] WITH PASSWORD = N'password';
GRANT VIEW SERVER STATE TO [telegraf];
GRANT VIEW ANY DEFINITION TO [telegraf];
That works on SQL Server, but in Azure it fails:
Securable class 'server' not supported in this version of SQL Server.
I wonder what I need to grant instead in order to solve this in the best possible way. We have a large number of databases running on the same server in an elastic pool, so if it is possible I would like to use a single user that logs in to the master and collects metrics for all the databases at once (the way it works with SQL Server). If that is impossible I can configure multiple logins and process one database at a time.
Perhaps I can grant VIEW DEFINITION at the database level, but VIEW SERVER STATE does not seem to be supported at all.
So, how should I configure the SQL Database login(s) for Telegraf with the SQL Server plugin to make it work?
EDIT:
Running as the super user for the server works without errors, but only produces metrics for master and tempdb. I need metrics for the many application databases and they are missing. Plus running as the super user is less than ideal.
Running as the super user for the server but connecting to a specific application database (add database in connection string) crashes with a nil pointer dereference and the log complains about VIEW DATABASE STATE permission denied in database master (the super user has access, but apparently not when connecting to a spefic database).
Granting VIEW DATABASE and VIEW DEFINITION to telegraf in an application database and connecting directly to that database as telegraf crashes with a nil pointer dereference and the log says the connection was closed.
EDIT 2:
Created bug report https://github.com/influxdata/telegraf/issues/4222.
EDIT 3:
As of the latest release the plugin works if the server admin account is used, so the issue has been solved. There is still no way to run with a less privileged account in Azure DB.
The answer:
GRANT VIEW SERVER STATE is not supported in Azure SQL Database.
On SQL Database Premium Tiers requires the VIEW DATABASE STATE
permission in the database. Permissions can not be granted in Master,
but the views can be queried in user databases. On SQL Database
Standard and Basic Tiers requires the SQL Database server admin
account due to security requirements following from multi tenancy of
those tiers.
Reason:
SQL Azure SQL is PaaS solution, therefore the most "server" specific features, DMVs, settings are blocked by purpose
References:
Grant View Server State - is it possible for a none SA user to have in Azure SQL?
SQL Azure VIEW DATABASE STATE permission denied in database 'master'
Possible workaround: (which is, anyway does not work in ewramner case)
CREATE LOGIN [telegraf] WITH PASSWORD = N'password';
USE [yourDB]
GRANT VIEW DEFINITION TO [telegraf];
GRANT VIEW DATABASE STATE TO [telegraf];
Therefore, (IMHO), there is no way to make such application working in SQL Azure without changing application code
I have been trying to research this subject and have not been able to glean any solid information, but what is the default "guest" account used for and should I revoke connect privilege from this account in my Production databases?
Guest access to master database is not enabled by default on SQL Azure Database service. With on premise SQL Server you always have guest access to master database even if no user is created in it for some login you're using to connect to the server. With SQL Azure a database user should also be created on master to be able to have guest access to DMVs like sys.database_usage and sys.bandwidth_usage.
My suggestion is to create database users only since logins created on the master can be disconnected while scaling the tiers or while failovers are occurring. I don't see why a guest access should be needed for master database.
We created a database and spent time loading the data. We might have accidentally changed some permissions, and now we are not longer able to access that database from the owner account (or any other). (We are both wading through the mud here)
Is there any way to restore the revoked permissions so we can access our data, or do we need to start all over?
Well, that's all in the docs:
You can reset the assigned permissions for your DB instance by
resetting the master password. For example, if you lock yourself out
of the db_owner role on your SQL Server database, you can reset the
db_owner role password by modifying the DB instance master password.
By changing the DB instance password, you can regain access to the DB
instance, access databases using the modified password for the
db_owner, and restore privileges for the db_owner role that may have
been accidentally revoked. You can change the DB instance password by
using the Amazon RDS console, the AWS CLI command modify-db-instance,
or by using the ModifyDBInstance action. For more information about
modifying a SQL Server DB instance, see Modifying a DB Instance
Running the Microsoft SQL Server Database Engine.
Source: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Troubleshooting.html#CHAP_Troubleshooting.ResetPassword