amazon-redshift-utils icon indicating copy to clipboard operation
amazon-redshift-utils copied to clipboard

Revoking privileges from RBAC roles using v_generate_user_grant_revoke_ddl

Open redthor opened this issue 2 years ago • 0 comments

When attempting to DROP ROLE my_role I received the error:

[55006] ERROR: role "my_role" cannot be dropped because the role has a privilege on some object

It would be great if we could use the v_generate_user_grant_revoke_ddl.sql script to generate the same content we can for users and groups, e.g:

SELECT ddl
FROM admin.v_generate_user_grant_revoke_ddl
WHERE ddltype = 'revoke'
  AND (grantee = 'my_role' OR grantor = 'my_role')
ORDER BY objseq, grantseq DESC;

This might be similar to: https://github.com/awslabs/amazon-redshift-utils/issues/620

Without this do you know how we can find the privileges a role has?

redthor avatar Nov 25 '22 05:11 redthor