Fine-grained access control via database roles
Embodiments of the present disclosure relate to sharing data using database roles. Database roles are generated within a database container of a provider account. Grants to a particular subset of the plurality of data objects of the database container may be assigned to each of the database roles, and each of the database roles are granted to a share object. The share object is mounted within a consumer account to generate an imported copy of each of the database roles. The imported copy of one or more of the database roles is granted to each of one or more account level roles of the consumer account. When a new object is added to a particular database role, it is immediately available for consumption by any account level roles to which the imported copy of the particular database role has been granted.
1 . A method comprising:
generating, within a database container of a provider account, a set of database roles, wherein the database container comprises a plurality of objects;
assigning, by a processing device, to each of the set of database roles, a set of grants to a particular subset of the plurality of objects of the database container;
generating an imported database container within a consumer account, the imported database container including an imported copy of each of the set of database roles;
granting, to each of one or more account level roles of the consumer account, the imported copy of one or more of the set of database roles; and
adding a new object to a particular database role of the set of database roles, wherein the new object is immediately available for consumption by any of the one or more account level roles to which the imported copy of the particular database role has been granted.
2 . The method of claim 1 , further comprising:
granting each of the set of database roles to a share object; and
mounting in the consumer account, the share object, wherein granting a database role of the set of database roles to the share object comprises:
creating a hidden role having no identifier;
granting the database role to the hidden role; and
granting the hidden role to the share object.
3 . The method of claim 2 , wherein the hidden role comprises a database role or an account level role.
4 . The method of claim 2 , wherein any objects granted by the provider account to the share object will not result in objects being automatically created in the consumer account.
5 . The method of claim 1 , further comprising:
granting a first database role of the set of database roles to each of a set of share objects.
6 . The method of claim 5 , wherein granting the first database role to each of the set of share objects comprises:
creating a hidden role having no identifier for each of the set of share objects, thereby creating a set of hidden roles;
granting the first database role to each of the set of hidden roles; and
granting each of the set of hidden roles to the corresponding share object of the set of share objects.
7 . The method of claim 1 , wherein adding the new object to the particular database role of the set of database roles database roles does not involve creation in the consumer account of a proxy object that represents the new object and on which the consumer account can grant local privileges.
8 . The method of claim 1 , wherein each of the set of database roles does not include grants to objects outside of the database container.
9 . A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
generate, within a database container of a provider account, a set of database roles, wherein the database container comprises a plurality of objects;
assign to each of the set of database roles, a set of grants to a particular subset of the plurality of objects of the database container;
generate an imported database container within a consumer account, the imported database container including an imported copy of each of the set of database roles;
grant, to each of one or more account level roles of the consumer account, the imported copy of one or more of the set of database roles; and
add a new object to a particular database role of the set of database roles, wherein the new object is immediately available for consumption by any of the one or more account level roles to which the imported copy of the particular database role has been granted.
10 . The system of claim 9 , wherein the processing device is further to:
grant each of the set of database roles to a share object; and
mount in the consumer account, the share object, wherein to grant a database role of the set of database roles to the share object, the processing device is to:
create a hidden role having no identifier;
grant the database role to the hidden role; and
grant the hidden role to the share object.
11 . The system of claim 10 , wherein the hidden role comprises a database role or an account level role.
12 . The system of claim 10 , wherein any objects granted by the provider account to the share object will not result in objects being automatically created in the consumer account.
13 . The system of claim 9 , wherein the processing device is further to:
grant a first database role of the set of database roles to each of a set of share objects.
14 . The system of claim 13 , wherein to grant the first database role to each of the set of share objects, the processing device is to:
create a hidden role having no identifier for each of the set of share objects, thereby creating a set of hidden roles;
grant the first database role to each of the set of hidden roles; and
grant each of the set of hidden roles to the corresponding share object of the set of share objects.
15 . The system of claim 9 , wherein when adding the new object to the particular database role of the set of database roles database roles, the processing device does not create in the consumer account, a proxy object that represents the new object and on which the consumer account can grant local privileges.
16 . The system of claim 9 , wherein each of the set of database roles does not include grants to objects outside of the database container.
17 . A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:
generate, within a database container of a provider account, a set of database roles, wherein the database container comprises a plurality of objects;
assign, by the processing device, to each of the set of database roles, a set of grants to a particular subset of the plurality of objects of the database container;
generate an imported database container within a consumer account, the imported database container including an imported copy of each of the set of database roles;
grant, to each of one or more account level roles of the consumer account, the imported copy of one or more of the set of database roles; and
add a new object to a particular database role of the set of database roles, wherein the new object is immediately available for consumption by any of the one or more account level roles to which the imported copy of the particular database role has been granted.
18 . The non-transitory computer-readable medium of claim 17 , wherein the processing device is further to:
grant each of the set of database roles to a share object; and
mount in the consumer account, the share object, wherein to grant a database role of the set of database roles to the share object, the processing device is to:
create a hidden role having no identifier;
grant the database role to the hidden role; and
grant the hidden role to the share object.
19 . The non-transitory computer-readable medium of claim 18 , wherein the hidden role comprises a database role or an account level role.
20 . The non-transitory computer-readable medium of claim 18 , wherein any objects granted by the provider account to the share object will not result in objects being automatically created in the consumer account.
21 . The non-transitory computer-readable medium of claim 17 , wherein the processing device is further to:
grant a first database role of the set of database roles to each of a set of share objects.
22 . The non-transitory computer-readable medium of claim 21 , wherein to grant the first database role to each of the set of share objects, the processing device is to:
create a hidden role having no identifier for each of the set of share objects, thereby creating a set of hidden roles;
grant the first database role to each of the set of hidden roles; and
grant each of the set of hidden roles to the corresponding share object of the set of share objects.
23 . The non-transitory computer-readable medium of claim 17 , wherein when adding the new object to the particular database role of the set of database roles database roles, the processing device does not create in the consumer account, a proxy object that represents the new object and on which the consumer account can grant local privileges.
24 . The non-transitory computer-readable medium of claim 17 , wherein each of the set of database roles does not include grants to objects outside of the database container.