aws / aws/aws-cdk

(aws-redshift-alpha): (provide the ability to reduce schema privileges for a user)

Open
#22,397 0 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-redshift effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

The User construct in the library creates a new user for the Redshift database. This user has no Table access privileges and there is a good mechanism to add only the access desired. But the user by default has Create privileges on the schema (e.g. - the user can create new tables in the schema and have full access to those new tables. It would be nice to have a way to prevent this, either:

* Create the user with no schema privileges and add a addSchemaPrivileges() method to User
* Specify user privileges in the schema in the props
* Allow the revocation of default privileges after creation (almost didn't include this, I don't think it's a very good approach)

The first option seems most in line with patterns you have already established in the library - although I'm not sure if it is invalidated by some subtlety in Redshift that I'm missing.

### Use Case

We're writing an aws-firehose-redshift construct in the AWS Solutions Constructs library. One of our benefits is implementing best practices for each service and between services - in this case it is recommended that the Redshift user assumed by Firehose be limited to INSERT only privileges and only on the destination table.

### Proposed Solution

I think I did this up above...

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.37.1-alpha.0

### Environment details (OS name and version, etc.)

macOS Monterey 12.6

Contributor guide

Open the contributing guide

Research direction

Start by locating the aws-redshift-alpha User construct and its existing schema and table privilege APIs. Review how Redshift assigns default schema privileges and compare the proposed approaches; done means the construct can restrict a Firehose user's access to the intended destination-table privileges, with tests covering the resulting permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, databases
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.