privileges

Creates, updates, deletes, gets or lists a privileges resource.

Overview

Name	privileges
Type	Resource
Id	snowflake.grant.privileges

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
grant_privilege	insert	granteeType, granteeName, securableType, securableName, endpoint		Endpoint to indicate that the privileges listed in the request body should be granted.
grant_group_privilege	insert	granteeType, granteeName, bulkGrantType, securableTypePlural, scopeType, scopeName, endpoint		Endpoint to indicate that the privileges listed in the request body should be granted to all securables of this type in the given scope.
revoke_privilege	delete	granteeType, granteeName, securableType, securableName, privilege, endpoint	deleteMode	Endpoint to indicate that the privilege listed in the path should be revoked.
revoke_group_privilege	delete	granteeType, granteeName, bulkGrantType, securableTypePlural, scopeType, scopeName, privilege, endpoint	deleteMode	Endpoint to indicate that the privilege listed on the group securable in the given scope should be revoked.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
bulkGrantType	string	String that species whether this group privilege should be on ALL or FUTURE resources of the specified plural type
endpoint	string	Organization and Account Name (default: orgid-acctid)
granteeName	string	String that specifies the name of the privilege grantee.
granteeType	string	String that specifies the type of resource that is the privilege grantee.
privilege	string	String that specifies a privilege to be revoked
scopeName	string	String that specifies the name of resource that is the scope of an ALL/FUTURE privilege
scopeType	string	String that specifies the type of resource that is the scope of an ALL/FUTURE privilege. Can only be DATABASE or SCHEMA
securableName	string	String that specifies the name of resource that is being secured by a privilege.
securableType	string	String that specifies the type of resource that is being secured by a privilege.
securableTypePlural	string	String that specifies the plural of the type of resource that is being secured by an ALL/FUTURE privilege. Must be either "schemas" or any plural object type that can nest under a schema such as "tables"
deleteMode	string	If "cascade", recursively revoke the grant from sub-grantees to which this privilege was re-granted. Acceptable values are "restrict" or "cascade".

INSERT examples

grant_privilege

Endpoint to indicate that the privileges listed in the request body should be granted.

INSERT INTO snowflake.grant.privileges (
data__privileges,
data__grant_option,
data__created_on,
data__grantee_type,
data__grantee_name,
data__securable_type,
data__securable_name,
data__granted_by_role_type,
data__granted_by_name,
granteeType,
granteeName,
securableType,
securableName,
endpoint
)
SELECT 
'{{ privileges }}',
{{ grant_option }},
'{{ created_on }}',
'{{ grantee_type }}',
'{{ grantee_name }}',
'{{ securable_type }}',
'{{ securable_name }}',
'{{ granted_by_role_type }}',
'{{ granted_by_name }}',
'{{ granteeType }}',
'{{ granteeName }}',
'{{ securableType }}',
'{{ securableName }}',
'{{ endpoint }}'
;

grant_group_privilege

Endpoint to indicate that the privileges listed in the request body should be granted to all securables of this type in the given scope.

INSERT INTO snowflake.grant.privileges (
data__privileges,
data__grant_option,
data__created_on,
data__grantee_type,
data__grantee_name,
data__securable_type,
data__securable_name,
data__granted_by_role_type,
data__granted_by_name,
granteeType,
granteeName,
bulkGrantType,
securableTypePlural,
scopeType,
scopeName,
endpoint
)
SELECT 
'{{ privileges }}',
{{ grant_option }},
'{{ created_on }}',
'{{ grantee_type }}',
'{{ grantee_name }}',
'{{ securable_type }}',
'{{ securable_name }}',
'{{ granted_by_role_type }}',
'{{ granted_by_name }}',
'{{ granteeType }}',
'{{ granteeName }}',
'{{ bulkGrantType }}',
'{{ securableTypePlural }}',
'{{ scopeType }}',
'{{ scopeName }}',
'{{ endpoint }}'
;

Manifest

# Description fields are for documentation purposes
- name: privileges
  props:
    - name: granteeType
      value: string
      description: Required parameter for the privileges resource.
    - name: granteeName
      value: string
      description: Required parameter for the privileges resource.
    - name: securableType
      value: string
      description: Required parameter for the privileges resource.
    - name: securableName
      value: string
      description: Required parameter for the privileges resource.
    - name: endpoint
      value: string
      description: Required parameter for the privileges resource.
    - name: bulkGrantType
      value: string
      description: Required parameter for the privileges resource.
    - name: securableTypePlural
      value: string
      description: Required parameter for the privileges resource.
    - name: scopeType
      value: string
      description: Required parameter for the privileges resource.
    - name: scopeName
      value: string
      description: Required parameter for the privileges resource.
    - name: privileges
      value: array
      description: >
        Privilege type
        
    - name: grant_option
      value: boolean
      description: >
        Can grantee pass this privilege down?
        
    - name: created_on
      value: string
    - name: grantee_type
      value: string
      description: >
        Entity type being granted to
        
    - name: grantee_name
      value: string
      description: >
        Specific name of object being granted to
        
    - name: securable_type
      value: string
      description: >
        Type of object granted on
        
    - name: securable_name
      value: string
      description: >
        Name of specific object granted on (not name of privilege!)
        
    - name: granted_by_role_type
      value: string
      description: >
        Type of role that granted this privilege to this grantee
        
    - name: granted_by_name
      value: string
      description: >
        The role that granted this privilege to this grantee
        

DELETE examples

revoke_privilege

Endpoint to indicate that the privilege listed in the path should be revoked.

DELETE FROM snowflake.grant.privileges
WHERE granteeType = '{{ granteeType }}' --required
AND granteeName = '{{ granteeName }}' --required
AND securableType = '{{ securableType }}' --required
AND securableName = '{{ securableName }}' --required
AND privilege = '{{ privilege }}' --required
AND endpoint = '{{ endpoint }}' --required
AND deleteMode = '{{ deleteMode }}';

revoke_group_privilege

Endpoint to indicate that the privilege listed on the group securable in the given scope should be revoked.

DELETE FROM snowflake.grant.privileges
WHERE granteeType = '{{ granteeType }}' --required
AND granteeName = '{{ granteeName }}' --required
AND bulkGrantType = '{{ bulkGrantType }}' --required
AND securableTypePlural = '{{ securableTypePlural }}' --required
AND scopeType = '{{ scopeType }}' --required
AND scopeName = '{{ scopeName }}' --required
AND privilege = '{{ privilege }}' --required
AND endpoint = '{{ endpoint }}' --required
AND deleteMode = '{{ deleteMode }}';