awslabs / awslabs/amazon-redshift-utils

group privileges not picked up by `v_generate_user_grant_revoke_ddl`

Open
#509 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.8k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

I'm trying to drop a group from my redshift cluster. Using the latest version of v_generate_user_grant_revoke_ddl, I'm running the following query to get the DDL statements to run for the group privileges:
```sql
select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and username='' order by grantseq;
```

This is the statement documented at https://aws.amazon.com/premiumsupport/knowledge-center/redshift-user-cannot-be-dropped/ except that the sequence number column has been renamed since the article was written (NB: I've also provided feedback on the page saying it's out of date and needs to be updated to reflect the column name changes).

The query returns an empty result set, which leads me to believe I'm clear to drop the group, however when I do so, I get the following error:

```
SQL Error [500310] [55006]: [Amazon](500310) Invalid operation: group "" cannot be dropped because the group has a privilege on some object;
```

I'm gonna have to dig into the view definition and see if I can figure out where the missing privileges are. I will add comments to this ticket with my findings.

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the definition of admin.v_generate_user_grant_revoke_ddl and reproduce the query filtering ddltype='revoke' and username=''. Compare its results with the privileges that prevent the group from being dropped; done means the view exposes those group privileges in the generated revoke DDL.

Written by the indexing model from the issue text.

Assessment

Tech stack
sql
Domain
databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.