(aws-redshift-alpha): (provide the ability to reduce schema privileges for a user)
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
The User construct in the library creates a new user for the Redshift database. This user has no Table access privileges and there is a good mechanism to add only the access desired. But the user by default has Create privileges on the schema (e.g. - the user can create new tables in the schema and have full access to those new tables. It would be nice to have a way to prevent this, either:
* Create the user with no schema privileges and add a addSchemaPrivileges() method to User
* Specify user privileges in the schema in the props
* Allow the revocation of default privileges after creation (almost didn't include this, I don't think it's a very good approach)
The first option seems most in line with patterns you have already established in the library - although I'm not sure if it is invalidated by some subtlety in Redshift that I'm missing.
### Use Case
We're writing an aws-firehose-redshift construct in the AWS Solutions Constructs library. One of our benefits is implementing best practices for each service and between services - in this case it is recommended that the Redshift user assumed by Firehose be limited to INSERT only privileges and only on the destination table.
### Proposed Solution
I think I did this up above...
### Other Information
_No response_
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.37.1-alpha.0
### Environment details (OS name and version, etc.)
macOS Monterey 12.6
Contributor guide
Research direction
Start by locating the aws-redshift-alpha User construct and its existing schema and table privilege APIs. Review how Redshift assigns default schema privileges and compare the proposed approaches; done means the construct can restrict a Firehose user's access to the intended destination-table privileges, with tests covering the resulting permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100