Fine-grained access control via database roles
Embodiments of the present disclosure provide systems and methods for defining database roles to allow sharing of the objects within a database in a more granular fashion. A database role is created within a database, and privileges are granted to the database role by a provider account. The database role may be granted to a share object, which would result in the share object being indirectly granted all privileges that have been granted to the database role. Once the share object has been hydrated in the consumer account, the local administrator can then decide which local roles are granted usage on the shared database role, thus ultimately allowing some level of filtering as to which shared objects can be accessed by which local roles.
1. A method comprising:
generating, within a database of a provider account, a database role having a different object type from any of a plurality of objects the database is comprised of;
assigning to the database role, a set of grants to a first subset of the plurality of data objects of the database;
granting the database role to a share object;
assigning, to the share object, a set of grants to a second subset of the plurality of objects of the database;
mounting, within a consumer account, the share object to generate an imported database within the consumer account, the imported database including an imported copy of the database role; and
granting the imported copy of the database role to an account level role of the consumer account.
2. The method of claim 1 , further comprising:
updating the database with an additional object; and
assigning to the database role, a grant to the additional object, wherein the additional object is immediately available to the account level role of the consumer account.
3. The method of claim 2 , wherein no new objects are created by the consumer account in response to the additional object being added to the database.
4. The method of claim 1 , wherein the imported database may access the first and second subsets of the plurality of data objects and the account level role may access the first subset of the plurality of data objects.
5. The method of claim 1 , wherein the database role does not include grants to objects outside of the database.
6. The method of claim 1 , wherein granting the database role to the share object comprises:
creating a hidden role;
granting the database role to the hidden role; and
granting the hidden role to the share object.
7. The method of claim 6 , wherein the hidden role comprises a database role or an account level role.
8. A system comprising:
a memory; and
a processing device, operatively coupled to the memory, the processing device to:
generate, within a database of a provider account, a database role having a different object type from any of a plurality of objects the database is comprised of;
assign to the database role, a set of grants to a first subset of the plurality of data objects of the database;
grant the database role to a share object;
assign, to the share object, a set of grants to a second subset of the plurality of objects of the database;
mount, within a consumer account, the share object to generate an imported database within the consumer account, the imported database including an imported copy of the database role; and
grant the imported copy of the database role to an account level role of the consumer account.
9. The system of claim 8 , wherein the processing device is further to:
update the database with an additional object; and
assign to the database role, a grant to the additional object, wherein the additional object is immediately available to the account level role of the consumer account.
10. The system of claim 9 , wherein no new objects are created by the consumer account in response to the additional object being added to the database.
11. The system of claim 8 , wherein the imported database may access the first and second subsets of the plurality of data objects and the account level role may access the first subset of the plurality of data objects.
12. The system of claim 8 , wherein the database role does not include grants to objects outside of the database.
13. The system of claim 8 , wherein to grant the database role to the share object, the processing device is to:
create a hidden role;
grant the database role to the hidden role; and
grant the hidden role to the share object.
14. The system of claim 13 , wherein the hidden role comprises a database role or an account level role.
15. A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:
generate, within a database of a provider account, a database role having a different object type from any of a plurality of objects the database is comprised of;
assign to the database role, a set of grants to a first subset of the plurality of data objects of the database;
grant the database role to a share object;
assign, to the share object, a set of grants to a second subset of the plurality of objects of the database;
mount, within a consumer account, the share object to generate an imported database within the consumer account, the imported database including an imported copy of the database role; and
grant the imported copy of the database role to an account level role of the consumer account.
16. The non-transitory computer-readable medium of claim 15 , wherein the processing device is further to:
update the database with an additional object; and
assign to the database role, a grant to the additional object, wherein the additional object is immediately available to the account level role of the consumer account.
17. The non-transitory computer-readable medium of claim 16 , wherein no new objects are created by the consumer account in response to the additional object being added to the database.
18. The non-transitory computer-readable medium of claim 15 , wherein the imported database may access the first and second subsets of the plurality of data objects and the account level role may access the first subset of the plurality of data objects.
19. The non-transitory computer-readable medium of claim 15 , wherein the database role does not include grants to objects outside of the database.
20. The non-transitory computer-readable medium of claim 15 , wherein to grant the database role to the share object, the processing device is to:
create a hidden role;
grant the database role to the hidden role; and
grant the hidden role to the share object.
21. The non-transitory computer-readable medium of claim 20 , wherein the hidden role comprises a database role or an account level role.