user_grants

Creates, updates, deletes, gets or lists a user_grants resource.

Overview

Name	user_grants
Type	Resource
Id	snowflake.roles.user_grants

Fields

The following fields are returned by SELECT queries:

list

Name	Datatype	Description
containing_scope	object	Containing scope of the grant
created_on	string (date-time)	Date and time when the grant was created
granted_by	string	The role that granted this privilege to this grantee
privileges	array	List of privileges to be granted.
securable	object	Securable of the grant
securable_type	string	Type of the securable to be granted. Only ROLE is supported

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list	select	name, endpoint	showLimit	List all grants to the user
grant	insert	name, endpoint, securable_type		Grant a role to the user
revoke	exec	name, endpoint, securable_type		Revoke grants from the user

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
endpoint	string	Organization and account identifier (orgname-accountname) (default: orgname-accountname)
name	string	Identifier (i.e. name) for the resource.
showLimit	integer	Parameter to limit the maximum number of rows returned by a command.

SELECT examples

list

List all grants to the user

SELECT
containing_scope,
created_on,
granted_by,
privileges,
securable,
securable_type
FROM snowflake.roles.user_grants
WHERE name = '{{ name }}' -- required
AND endpoint = '{{ endpoint }}' -- required
AND showLimit = '{{ showLimit }}'
;

INSERT examples

grant

Grant a role to the user

INSERT INTO snowflake.roles.user_grants (
securable,
containing_scope,
securable_type,
privileges,
name,
endpoint
)
SELECT 
'{{ securable }}',
'{{ containing_scope }}',
'{{ securable_type }}' /* required */,
'{{ privileges }}',
'{{ name }}',
'{{ endpoint }}'
RETURNING
status
;

Manifest

# Description fields are for documentation purposes
- name: user_grants
props:
  - name: name
    value: "{{ name }}"
    description: Required parameter for the user_grants resource.
  - name: endpoint
    value: "{{ endpoint }}"
    description: Required parameter for the user_grants resource.
  - name: securable
    description: |
      Securable of the grant
    value:
      database: "{{ database }}"
      schema: "{{ schema }}"
      name: "{{ name }}"
  - name: containing_scope
    description: |
      Containing scope of the grant
    value:
      database: "{{ database }}"
      schema: "{{ schema }}"
  - name: securable_type
    value: "{{ securable_type }}"
    description: |
      Type of the securable to be granted. Only ROLE is supported
  - name: privileges
    value:
      - "{{ privileges }}"
    description: |
      List of privileges to be granted.

Lifecycle Methods

revoke

Revoke grants from the user

EXEC snowflake.roles.user_grants.revoke 
@name='{{ name }}' --required, 
@endpoint='{{ endpoint }}' --required 
@@json=
'{
"securable": "{{ securable }}", 
"containing_scope": "{{ containing_scope }}", 
"securable_type": "{{ securable_type }}", 
"privileges": "{{ privileges }}"
}'
;