awslabs / awslabs/amazon-redshift-utils
group privileges not picked up by `v_generate_user_grant_revoke_ddl`
- Dominant language
- Python
- Stars
- 2.8k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
I'm trying to drop a group from my redshift cluster. Using the latest version of v_generate_user_grant_revoke_ddl, I'm running the following query to get the DDL statements to run for the group privileges:
```sql
select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and username='' order by grantseq;
```
This is the statement documented at https://aws.amazon.com/premiumsupport/knowledge-center/redshift-user-cannot-be-dropped/ except that the sequence number column has been renamed since the article was written (NB: I've also provided feedback on the page saying it's out of date and needs to be updated to reflect the column name changes).
The query returns an empty result set, which leads me to believe I'm clear to drop the group, however when I do so, I get the following error:
```
SQL Error [500310] [55006]: [Amazon](500310) Invalid operation: group "" cannot be dropped because the group has a privilege on some object;
```
I'm gonna have to dig into the view definition and see if I can figure out where the missing privileges are. I will add comments to this ticket with my findings.
Contributor guide
Research direction
Start by inspecting the definition of admin.v_generate_user_grant_revoke_ddl and reproduce the query filtering ddltype='revoke' and username=''. Compare its results with the privileges that prevent the group from being dropped; done means the view exposes those group privileges in the generated revoke DDL.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- sql
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100