AWS redshift documentation change
Summary
Expanded syntax documentation and added examples for SHOW GRANTS command, including object qualification requirements and new syntax variations for functions/tables
Security assessment
The changes clarify how to properly check access grants, which supports security auditing but does not address a specific vulnerability. The documentation improvements help users verify permissions more accurately, which is a security best practice but not a direct response to a security issue.
Diff
diff --git a/redshift/latest/dg/r_SHOW_GRANTS.md b/redshift/latest/dg/r_SHOW_GRANTS.md index 57519c7e5..d018587ae 100644 --- a//redshift/latest/dg/r_SHOW_GRANTS.md +++ b//redshift/latest/dg/r_SHOW_GRANTS.md @@ -9 +9 @@ SyntaxParametersExamples -Displays grants for a user, role, or object. The object can be a database, a schema, a table, or a function. +Displays grants for a user, role, or object. The object can be a database, a schema, a table, or a function. When you specify an object, such as a table or function, you need to qualify it with two-part or three-part notation. For example, `schema_name.table_name` or `database_name.schema_name.table_name`. @@ -12,0 +13,2 @@ Displays grants for a user, role, or object. The object can be a database, a sch +The following is the syntax for showing grants on an object. Note that the second way of specifying a function is only valid for external schemas and databases created from a datashare. + @@ -15,3 +17,16 @@ Displays grants for a user, role, or object. The object can be a database, a sch - {DATABASE _database_name_ | FUNCTION _function_name_ | SCHEMA _schema_name_ | TABLE _table_name_} - [FOR {_username_ | ROLE _role_name_ | PUBLIC}] - [LIMIT _row_limit_] + { + DATABASE database_name | + FUNCTION {database_name.schema_name.function_name | schema_name.function_name } ( [ [ argname ] argtype [, ...] ] ) | + FUNCTION {database_name.schema_name.function_name | schema_name.function_name } | + SCHEMA {database_name.schema_name | schema_name} | + { TABLE {database_name.schema_name.table_name | schema_name.table_name} | table_name } + } + [FOR {username | ROLE role_name | PUBLIC}] + [LIMIT row_limit] + +The following is the syntax for showing grants for a user or role. + + + SHOW GRANTS FOR + {username | ROLE role_name} + [LIMIT row_limit] @@ -124,0 +140,66 @@ The following command shows all grants for a user named `alice`. +The following command shows all grants on a table named `t3` for a user named `alice`. Note that you can either use two-part or three-part notation to specify the table name. + + + SHOW GRANTS ON TABLE demo_db.demo_schema.t3 FOR alice; + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- + demo_schema | t3 | TABLE | ALTER | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | TRUNCATE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | DROP | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | TRIGGER | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | SELECT | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | INSERT | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | UPDATE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | DELETE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | RULE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | REFERENCES | 100 | alice | user | f | TABLE + (10 rows) + + SHOW GRANTS ON TABLE demo_schema.t3 FOR alice; + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- + demo_schema | t3 | TABLE | ALTER | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | TRUNCATE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | DROP | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | TRIGGER | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | SELECT | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | INSERT | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | UPDATE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | DELETE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | RULE | 100 | alice | user | f | TABLE + demo_schema | t3 | TABLE | REFERENCES | 100 | alice | user | f | TABLE + (10 rows) + +The following example shows all grants on a table named `t4`. Note the different ways that you can specify the table name. + + + SHOW GRANTS ON t4; + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- + public | t4 | TABLE | ALTER | 100 | alice | user | f | TABLE + public | t4 | TABLE | TRUNCATE | 100 | alice | user | f | TABLE + public | t4 | TABLE | DROP | 100 | alice | user | f | TABLE + public | t4 | TABLE | TRIGGER | 100 | alice | user | f | TABLE + public | t4 | TABLE | SELECT | 100 | alice | user | f | TABLE + public | t4 | TABLE | INSERT | 100 | alice | user | f | TABLE + public | t4 | TABLE | UPDATE | 100 | alice | user | f | TABLE + public | t4 | TABLE | DELETE | 100 | alice | user | f | TABLE + public | t4 | TABLE | RULE | 100 | alice | user | f | TABLE + public | t4 | TABLE | REFERENCES | 100 | alice | user | f | TABLE + (10 rows) + + SHOW GRANTS ON TABLE public.t4; + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- + public | t4 | TABLE | ALTER | 100 | alice | user | f | TABLE + public | t4 | TABLE | TRUNCATE | 100 | alice | user | f | TABLE + public | t4 | TABLE | DROP | 100 | alice | user | f | TABLE + public | t4 | TABLE | TRIGGER | 100 | alice | user | f | TABLE + public | t4 | TABLE | SELECT | 100 | alice | user | f | TABLE + public | t4 | TABLE | INSERT | 100 | alice | user | f | TABLE + public | t4 | TABLE | UPDATE | 100 | alice | user | f | TABLE + public | t4 | TABLE | DELETE | 100 | alice | user | f | TABLE + public | t4 | TABLE | RULE | 100 | alice | user | f | TABLE + public | t4 | TABLE | REFERENCES | 100 | alice | user | f | TABLE + (10 rows) +