AWS redshift medium security documentation change
Summary
Updated SHOW GRANTS documentation to include template support, required permissions section, syntax changes, and revised examples with additional columns
Security assessment
Added explicit 'Required permissions' section detailing authorization requirements for viewing grants. This clarifies security boundaries by specifying that only superusers, target users, role owners, or granted roles can view grants. The change improves security documentation by making permission requirements explicit, helping prevent unintended privilege escalation.
Diff
diff --git a/redshift/latest/dg/r_SHOW_GRANTS.md b/redshift/latest/dg/r_SHOW_GRANTS.md index a8d2b7323..4670c181f 100644 --- a//redshift/latest/dg/r_SHOW_GRANTS.md +++ b//redshift/latest/dg/r_SHOW_GRANTS.md @@ -5 +5 @@ -SyntaxParametersExamples +Required permissionsSyntaxParametersExamples @@ -11 +11,31 @@ Amazon Redshift will no longer support the creation of new Python UDFs starting -Displays grants for a user, role, or object. The object can be a database, a schema, a table, or a function. When you specify an object, such as a table or function, you need to qualify it with two-part or three-part notation. For example, `schema_name.table_name` or `database_name.schema_name.table_name`. +Displays grants for a user, role, or object. The object can be a database, a schema, a table, a function, or a template. When you specify an object, such as a table or function, you need to qualify it with two-part or three-part notation. For example, `schema_name.table_name` or `database_name.schema_name.table_name`. + +If more than 10,000 rows would results from SHOW GRANTS, then the command raises an error. + +## Required permissions + +To run SHOW GRANTS for a target user or role, the current user must satisfy one of the following criteria: + + * Be a superuser + + * Be the target user + + * Be the owner of the target role + + * Be granted the role + + + + +SHOW GRANTS for a target object will only display grants that are visible to the current user. A grant is visible to the current user if the current user satisfies one of the following criteria: + + * Be a superuser + + * Be the target user + + * Be granted owner of the granted role + + * Be granted the role targeted by the object grant + + + @@ -24,0 +55 @@ The following is the syntax for showing grants on an object. Note that the secon + TEMPLATE {database_name.schema_name.template_name | template_name} @@ -33,0 +65 @@ The following is the syntax for showing grants for a user or role. + [FROM DATABASE database_name] @@ -47,0 +80,5 @@ The name of the function to show grants on. +template_name + + +The name of the template to show grants on. + @@ -83 +120,13 @@ The following example displays all grants on a database named `dev`. - SHOW GRANTS ON DATABASE dev; + SHOW GRANTS on database demo_db; + + database_name | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope | grantor_name + ---------------+----------------+-------------+---------------+---------------+--------------+-----------------+-------------- + demo_db | ALTER | 112 | alice | user | f | TABLES | dbadmin + demo_db | TRUNCATE | 112 | alice | user | f | TABLES | dbadmin + demo_db | DROP | 112 | alice | user | f | TABLES | dbadmin + demo_db | INSERT | 112 | alice | user | f | TABLES | dbadmin + demo_db | TEMP | 0 | public | public | f | DATABASE | dbadmin + demo_db | SELECT | 112 | alice | user | f | TABLES | dbadmin + demo_db | UPDATE | 112 | alice | user | f | TABLES | dbadmin + demo_db | DELETE | 112 | alice | user | f | TABLES | dbadmin + demo_db | REFERENCES | 112 | alice | user | f | TABLES | dbadmin @@ -85,12 +133,0 @@ The following example displays all grants on a database named `dev`. - database_name | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope - ---------------+----------------+-------------+---------------+---------------+--------------+----------------- - dev | TRUNCATE | 101 | alice | user | f | TABLES - dev | DROP | 101 | alice | user | f | TABLES - dev | INSERT | 101 | alice | user | f | TABLES - dev | ALTER | 101 | alice | user | f | TABLES - dev | TEMP | 0 | public | public | f | DATABASE - dev | DELETE | 101 | alice | user | f | TABLES - dev | SELECT | 101 | alice | user | f | TABLES - dev | UPDATE | 101 | alice | user | f | TABLES - dev | REFERENCES | 101 | alice | user | f | TABLES - (9 rows) @@ -101 +138 @@ The following command shows all grants on a schema named `demo`. - SHOW GRANTS ON SCHEMA demo; + SHOW GRANTS ON SCHEMA demo_schema; @@ -103,7 +140,6 @@ The following command shows all grants on a schema named `demo`. - schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope - -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- - demo | demo | SCHEMA | ALTER | 101 | alice | user | f | SCHEMA - demo | demo | SCHEMA | DROP | 101 | alice | user | f | SCHEMA - demo | demo | SCHEMA | USAGE | 101 | alice | user | f | SCHEMA - demo | demo | SCHEMA | CREATE | 101 | alice | user | f | SCHEMA - (4 rows) + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope | database_name | grantor_name + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+-----------------+---------------+-------------- + demo_schema | demo_schema | SCHEMA | ALTER | 112 | alice | user | f | SCHEMA | db1 | dbadmin + demo_schema | demo_schema | SCHEMA | DROP | 112 | alice | user | f | SCHEMA | db1 | dbadmin + demo_schema | demo_schema | SCHEMA | USAGE | 112 | alice | user | f | SCHEMA | db1 | dbadmin + demo_schema | demo_schema | SCHEMA | CREATE | 112 | alice | user | f | SCHEMA | db1 | dbadmin @@ -116,23 +152,30 @@ The following command shows all grants for a user named `alice`. - database_name | schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | privilege_scope - ---------------+-------------+-------------+-------------+----------------+-------------+---------------+---------------+----------------- - dev | | | DATABASE | INSERT | 101 | alice | user | TABLES - dev | | | DATABASE | SELECT | 101 | alice | user | TABLES - dev | | | DATABASE | UPDATE | 101 | alice | user | TABLES - dev | | | DATABASE | DELETE | 101 | alice | user | TABLES - dev | | | DATABASE | REFERENCES | 101 | alice | user | TABLES - dev | | | DATABASE | DROP | 101 | alice | user | TABLES - dev | | | DATABASE | TRUNCATE | 101 | alice | user | TABLES - dev | | | DATABASE | ALTER | 101 | alice | user | TABLES - dev | public | t1 | TABLE | INSERT | 101 | alice | user | TABLE - dev | public | t1 | TABLE | SELECT | 101 | alice | user | TABLE - dev | public | t1 | TABLE | UPDATE | 101 | alice | user | TABLE - dev | public | t1 | TABLE | DELETE | 101 | alice | user | TABLE - dev | public | t1 | TABLE | REFERENCES | 101 | alice | user | TABLE - dev | public | t1 | TABLE | DROP | 101 | alice | user | TABLE - dev | public | t1 | TABLE | TRUNCATE | 101 | alice | user | TABLE - dev | public | t1 | TABLE | ALTER | 101 | alice | user | TABLE - dev | demo | | SCHEMA | USAGE | 101 | alice | user | SCHEMA - dev | demo | | SCHEMA | CREATE | 101 | alice | user | SCHEMA - dev | demo | | SCHEMA | DROP | 101 | alice | user | SCHEMA - dev | demo | | SCHEMA | ALTER | 101 | alice | user | SCHEMA - (20 rows) + database_name | schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | privilege_scope | grantor_name + ---------------+-------------+-------------+-------------+----------------+-------------+---------------+---------------+-----------------+-------------- + demo_db | | | DATABASE | INSERT | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | SELECT | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | UPDATE | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | DELETE | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | REFERENCES | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | DROP | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | TRUNCATE | 124 | alice | user | TABLES | dbadmin + demo_db | | | DATABASE | ALTER | 124 | alice | user | TABLES | dbadmin + demo_db | demo_schema | | SCHEMA | USAGE | 124 | alice | user | SCHEMA | dbadmin + demo_db | demo_schema | | SCHEMA | CREATE | 124 | alice | user | SCHEMA | dbadmin + demo_db | demo_schema | | SCHEMA | DROP | 124 | alice | user | SCHEMA | dbadmin + demo_db | demo_schema | | SCHEMA | ALTER | 124 | alice | user | SCHEMA | dbadmin + demo_db | demo_schema | t1 | TABLE | INSERT | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | SELECT | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | UPDATE | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | DELETE | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | RULE | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | REFERENCES | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | TRIGGER | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | DROP | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | TRUNCATE | 124 | alice | user | TABLE | dbadmin + demo_db | demo_schema | t1 | TABLE | ALTER | 124 | alice | user | TABLE | dbadmin + + + SHOW GRANTS FOR alice FROM DATABASE second_db; + database_name | schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | privilege_scope | grantor_name + ---------------+-------------+-------------+-------------+----------------+-------------+---------------+---------------+-----------------+-------------- + second_db | public | t22 | TABLE | SELECT | 101 | alice | user | TABLE | dbadmin @@ -143,25 +186,29 @@ The following command shows all grants on a table named `t3` for a user named `a - SHOW GRANTS ON TABLE demo_db.demo_schema.t3 FOR alice; - schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope - -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- - demo_schema | t3 | TABLE | ALTER | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | TRUNCATE | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | DROP | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | SELECT | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | INSERT | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | UPDATE | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | DELETE | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | REFERENCES | 100 | alice | user | f | TABLE - (8 rows) - - SHOW GRANTS ON TABLE demo_schema.t3 FOR alice; - schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope - -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+----------------- - demo_schema | t3 | TABLE | ALTER | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | TRUNCATE | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | DROP | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | SELECT | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | INSERT | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | UPDATE | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | DELETE | 100 | alice | user | f | TABLE - demo_schema | t3 | TABLE | REFERENCES | 100 | alice | user | f | TABLE - (8 rows) + SHOW GRANTS ON TABLE demo_db.demo_schema.t3 FOR ALICE; + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope | database_name | grantor_name + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+-----------------+---------------+-------------- + demo_schema | t3 | TABLE | ALTER | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | TRUNCATE | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | DROP | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | TRIGGER | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | SELECT | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | INSERT | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | UPDATE | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | DELETE | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | RULE | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | REFERENCES | 130 | alice | user | f | TABLE | demo_db | dbadmin + + + SHOW GRANTS ON TABLE demo_schema.t3 FOR ALICE; + schema_name | object_name | object_type | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope | database_name | grantor_name + -------------+-------------+-------------+----------------+-------------+---------------+---------------+--------------+-----------------+---------------+-------------- + demo_schema | t3 | TABLE | ALTER | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | TRUNCATE | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | DROP | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | TRIGGER | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | SELECT | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | INSERT | 130 | alice | user | f | TABLE | demo_db | dbadmin + demo_schema | t3 | TABLE | UPDATE | 130 | alice | user | f | TABLE | demo_db | dbadmin