awslabs / awslabs/amazon-redshift-utils
Revoking privileges from RBAC roles using v_generate_user_grant_revoke_ddl
- Dominant language
- Python
- Stars
- 2.8k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
When attempting to `DROP ROLE my_role` I received the error:
```
[55006] ERROR: role "my_role" cannot be dropped because the role has a privilege on some object
```
It would be great if we could use the [v_generate_user_grant_revoke_ddl.sql](https://github.com/awslabs/amazon-redshift-utils/blob/master/src/AdminViews/v_generate_user_grant_revoke_ddl.sql) script to generate the same content we can for users and groups, e.g:
```sql
SELECT ddl
FROM admin.v_generate_user_grant_revoke_ddl
WHERE ddltype = 'revoke'
AND (grantee = 'my_role' OR grantor = 'my_role')
ORDER BY objseq, grantseq DESC;
```
This might be similar to: https://github.com/awslabs/amazon-redshift-utils/issues/620
Without this do you know how we can find the privileges a role has?
Contributor guide
Research direction
Start by reading src/AdminViews/v_generate_user_grant_revoke_ddl.sql and compare its handling of users and groups with the requested RBAC role case. Use the provided query and the DROP ROLE failure as the reproduction; done means the view generates revoke DDL when the grantee or grantor is my_role.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- sql
- Domain
- databases
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100