awslabs / awslabs/amazon-redshift-utils

Revoking privileges from RBAC roles using v_generate_user_grant_revoke_ddl

Open
#654 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.8k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

When attempting to `DROP ROLE my_role` I received the error:

```
[55006] ERROR: role "my_role" cannot be dropped because the role has a privilege on some object
```

It would be great if we could use the [v_generate_user_grant_revoke_ddl.sql](https://github.com/awslabs/amazon-redshift-utils/blob/master/src/AdminViews/v_generate_user_grant_revoke_ddl.sql) script to generate the same content we can for users and groups, e.g:

```sql
SELECT ddl
FROM admin.v_generate_user_grant_revoke_ddl
WHERE ddltype = 'revoke'
AND (grantee = 'my_role' OR grantor = 'my_role')
ORDER BY objseq, grantseq DESC;
```

This might be similar to: https://github.com/awslabs/amazon-redshift-utils/issues/620

Without this do you know how we can find the privileges a role has?

Contributor guide

Open the contributing guide

Research direction

Start by reading src/AdminViews/v_generate_user_grant_revoke_ddl.sql and compare its handling of users and groups with the requested RBAC role case. Use the provided query and the DROP ROLE failure as the reproduction; done means the view generates revoke DDL when the grantee or grantor is my_role.

Written by the indexing model from the issue text.

Assessment

Tech stack
sql
Domain
databases
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.