database_role_future_grants

Creates, updates, deletes, gets or lists a database_role_future_grants resource.

Overview

Name	database_role_future_grants
Type	Resource
Id	snowflake.roles.database_role_future_grants

Fields

The following fields are returned by SELECT queries:

list

Name	Datatype	Description
containing_scope	object	Containing scope of the grant
created_on	string (date-time)	Date and time when the grant was created
grant_option	boolean	If true, allows the recipient role to grant the privileges to other roles.
granted_by	string	The role that granted this privilege to this grantee
privileges	array	List of privileges to be granted.
securable	object	Securable of the grant
securable_type	string	Type of the securable to be granted.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list	select	database_name, name, endpoint	showLimit	List all future grants to the role
grant	insert	database_name, name, endpoint, securable_type		Grant future privileges to the role
revoke	exec	database_name, name, endpoint, securable_type	mode	Revoke future grants from the role

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
database_name	string	Identifier (i.e. name) for the database to which the resource belongs. You can use the /api/v2/databases GET request to get a list of available databases.
endpoint	string	Organization and account identifier (orgname-accountname) (default: orgname-accountname)
name	string	Identifier (i.e. name) for the resource.
mode	string	Parameter determines whether the revoke operation succeeds or fails for the privileges, based on the whether the privileges had been re-granted to another role. - restrict: If the privilege being revoked has been re-granted to another role, the REVOKE command fails. - cascade: If the privilege being revoked has been re-granted, the REVOKE command recursively revokes these dependent grants. If the same privilege on an object has been granted to the target role by a different grantor (parallel grant), that grant is not affected and the target role retains the privilege.
showLimit	integer	Parameter to limit the maximum number of rows returned by a command.

SELECT examples

list

List all future grants to the role

SELECT
containing_scope,
created_on,
grant_option,
granted_by,
privileges,
securable,
securable_type
FROM snowflake.roles.database_role_future_grants
WHERE database_name = '{{ database_name }}' -- required
AND name = '{{ name }}' -- required
AND endpoint = '{{ endpoint }}' -- required
AND showLimit = '{{ showLimit }}'
;

INSERT examples

grant

Grant future privileges to the role

INSERT INTO snowflake.roles.database_role_future_grants (
securable,
containing_scope,
securable_type,
grant_option,
privileges,
database_name,
name,
endpoint
)
SELECT 
'{{ securable }}',
'{{ containing_scope }}',
'{{ securable_type }}' /* required */,
{{ grant_option }},
'{{ privileges }}',
'{{ database_name }}',
'{{ name }}',
'{{ endpoint }}'
RETURNING
status
;

Manifest

# Description fields are for documentation purposes
- name: database_role_future_grants
props:
  - name: database_name
    value: "{{ database_name }}"
    description: Required parameter for the database_role_future_grants resource.
  - name: name
    value: "{{ name }}"
    description: Required parameter for the database_role_future_grants resource.
  - name: endpoint
    value: "{{ endpoint }}"
    description: Required parameter for the database_role_future_grants resource.
  - name: securable
    description: |
      Securable of the grant
    value:
      database: "{{ database }}"
      schema: "{{ schema }}"
      service: "{{ service }}"
      name: "{{ name }}"
  - name: containing_scope
    description: |
      Containing scope of the grant
    value:
      database: "{{ database }}"
      schema: "{{ schema }}"
  - name: securable_type
    value: "{{ securable_type }}"
    description: |
      Type of the securable to be granted.
  - name: grant_option
    value: {{ grant_option }}
    description: |
      If true, allows the recipient role to grant the privileges to other roles.
  - name: privileges
    value:
      - "{{ privileges }}"
    description: |
      List of privileges to be granted.

Lifecycle Methods

revoke

Revoke future grants from the role

EXEC snowflake.roles.database_role_future_grants.revoke 
@database_name='{{ database_name }}' --required, 
@name='{{ name }}' --required, 
@endpoint='{{ endpoint }}' --required, 
@mode='{{ mode }}' 
@@json=
'{
"securable": "{{ securable }}", 
"containing_scope": "{{ containing_scope }}", 
"securable_type": "{{ securable_type }}", 
"grant_option": {{ grant_option }}, 
"privileges": "{{ privileges }}"
}'
;