https://linen.dev logo
Join Slack
Powered by
Does meltano help create users? Does it create the...
# announcements
n
Does meltano help create users? Does it create the scratch schema for each user as well?
d
@nehil_jain We have started an RBAC implementation, but have reprioritized on other work for the near term as we're a small team. @micael_bergeron Is out on vacation, but he can lend some context when he gets back.
n
oh ok
y
@nehil_jain Nope at its current version it does not create new users / schemas / tables / etc. When you make the permissions script work by following my advice in your previous comment, you'll get proper feedback by the script that X, Y, Z users are not defined in Snowflake or that the scratch schema for user X is missing.
We want to play it safe with the permissions script. When we are sure that everything works as expected, we can turn on a mode where missing objects can be also created.
n
I see so how does gitlab create users. I was reading that the dbt team at gitlab uses meltano bot to manage users and permissions
That makes sense, if I were to design it I would design v0 to be as minimal as possible. creation can be v1 and deletion can be v2
So if I run create commands, will meltano setup all the rest in terms of access controls???
y
We are playing it really really really safe with this script: Try it it out and you'll see that we are not even allowing the script to run the final SQL command generated. Current version: - Full support for an extended role specification, suited for Snowflake - Check that everything is defined and report errors on the spec or things missing on the server - If everything is ok --> output the commands necessary to setup your snawlake (either everything or just the 
--diff
to what you currently have) Manual steps in current version: - Creating DBs/Schemas/Tables (done by other scripts) - Creating Users (carefully curated process) - Doing something for errors (e.g. a schema missing) - Running the final SQL commands (we are still opting-in to check, copy/paste and run to be on the safe side)
As you can imagine, creating missing DBs/Schemas/Users and running the final commands is pretty trivial compared to all the other steps, but it is very important to make sure that we are not breaking something 🙂
n
👍
Setting env variables worked. Thanks for all your help @yannis_roussos Now I have codified all RBAC to in roles.yaml
When I run the output commands I get this error 
SQL compilation error: Database 'DB_APPS' was not imported from a share
the command this is thrown on is 
GRANT IMPORTED PRIVILEGES ON DATABASE db_apps TO ROLE analyst;
y
If you get that command in the output, then you have defined the 
db_apps
DB as a shared database in your spec. If it is not, you should define with 
shared: no
Copy code
version: "1.0"

# Databases
databases:
    - regular_db:
        shared: no

    - shared_db:
        shared: yes
...
For databases, the IMPORTED PRIVILEGES privilege only applies to shared databases (i.e. databases created from a share). We use the 
shared
boolean attribute when defining DBs on a spec in order to keep that information and use it when assigning privileges to a shared DB or objects that belong to a shared DB (as you need to have the imported privileges on the DB first) More on SHARED DBs and Data Consumers: https://docs.snowflake.net/manuals/user-guide/data-share-consumers.html
Thank you @nehil_jain! It is our mistake not properly documenting this property of DBs in Snowflake. We'll add something similar to my comment above to our documentation
n
Oh thats what a share db is. Okay, none of my dbs are shared. Will turn share off for all 😄
Another question, can we do revoke using meltano permissions or it is grants only? What happens I remove some member of items in the spec?
y
That's a great question! We should support something similar. But at the moment we have no revoking at all.
n
Yeah thats a bummer, it makes it hard to figure out out RBAC iteratively
@yannis_roussos I think there is some bug around can_login flag
Copy code
- stitch:
      can_login: no
      member_of:
        - loader
        - stitc
this generates ALTER USER stitch SET DISABLED = TRUE;
which doesnt allow the user to connect to snowflake, which is different from login
y
You are right! Can you please report this one on our project? It would be great if you could add the proper expected queries also 🙂
n
Sure, will do
2 Views
Open in Slack
PreviousNext
Powered by