AWS redshift: Document SHOW GRANTS output for DEBUG permission grants
Summary
Adds a note and example output showing that SHOW GRANTS on a federated-permissions database also reports DEBUG permission grants, with identity_type values global_user, global_group, and admins_of_account.
Security assessment
The change improves auditability by documenting that SHOW GRANTS surfaces DEBUG privilege holders (who can view unredacted secure logs), supporting permission review. It is visibility/audit documentation, not a fix for a specific weakness.
Evidence
+For a database in an Amazon Redshift warehouse with federated permissions, SHOW GRANTS also displays DEBUG permission grants, including grants to a global identity, grants to an IdC group, and grants to the administrators of a consumer account.
Diff
diff --git a/redshift/latest/dg/r_SHOW_GRANTS.md b/redshift/latest/dg/r_SHOW_GRANTS.md index e25dd4658..8aa366405 100644 --- a//redshift/latest/dg/r_SHOW_GRANTS.md +++ b//redshift/latest/dg/r_SHOW_GRANTS.md @@ -16,0 +17,2 @@ If more than 10,000 rows would results from SHOW GRANTS, then the command raises +For a database in an Amazon Redshift warehouse with federated permissions, SHOW GRANTS also displays DEBUG permission grants, including grants to a global identity, grants to an IdC group, and grants to the administrators of a consumer account. For more information about the DEBUG permission, see [Usage notes for granting the DEBUG permission](./r_GRANT-usage-notes.html#r_GRANT-usage-notes-debug). + @@ -136,0 +139,12 @@ The following example displays all grants on a database named `dev`. +The following example shows the DEBUG permission grants on a database named `sales_db` in an Amazon Redshift warehouse with federated permissions. A grant to a global identity appears with an `identity_type` of `global_user`, a grant to an IdC group appears with an `identity_type` of `global_group`, and a grant to account administrators appears with an `identity_type` of `admins_of_account`. + + + SHOW GRANTS ON DATABASE sales_db; + + database_name | privilege_type | identity_id | identity_name | identity_type | admin_option | privilege_scope | grantor_name + ---------------+----------------+-------------+--------------------------------------+-------------------+--------------+-----------------+-------------- + sales_db | DEBUG | 145 | IAM:sales_auditor | global_user | f | DATABASE | dbadmin + sales_db | DEBUG | 178 | myidc:audit_team | global_group | f | DATABASE | dbadmin + sales_db | DEBUG | 203 | 123456789012 | admins_of_account | f | DATABASE | dbadmin + +