Merge pull request #113 from Sage-Bionetworks/snow-220-grant-tasks-to…

…-sysadmin [SNOW-220] Revert ownership of tasks to sysadmin
Sage-Bionetworks · Jan 27, 2025 · 115670d · 115670d
2 parents 679ee68 + e05ff77
commit 115670d
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 23 deletions.
diff --git a/admin/future_grants/V1.2.1__revoke_nonexistent_ownership.sql b/admin/future_grants/V1.2.1__revoke_nonexistent_ownership.sql
@@ -0,0 +1,14 @@
+-- These object types don't yet exist in this schema.
+-- We don't want to provide future grants unless there are preexisting objects.
+REVOKE OWNERSHIP
+	ON FUTURE STAGES
+	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
+	FROM DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN;
+REVOKE OWNERSHIP
+	ON FUTURE VIEWS
+	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
+	FROM DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN;
+REVOKE OWNERSHIP
+	ON FUTURE TASKS
+	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
+	FROM DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN;
diff --git a/admin/grants.sql b/admin/grants.sql
@@ -551,10 +551,15 @@ GRANT OWNERSHIP
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
 	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_ALL_ADMIN
 	COPY CURRENT GRANTS;
+-- GRANT OWNERSHIP
+-- 	ON ALL TASKS
+-- 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
+-- 	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_ALL_ADMIN
+-- 	COPY CURRENT GRANTS;
 GRANT OWNERSHIP
 	ON ALL TASKS
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_ALL_ADMIN
+	TO ROLE SYSADMIN
 	COPY CURRENT GRANTS;
 
 -- SYNAPSE_RAW
@@ -577,15 +582,15 @@ GRANT OWNERSHIP
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
 	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ADMIN
 	COPY CURRENT GRANTS;
-GRANT OWNERSHIP
-	ON ALL VIEWS
-	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ADMIN
-	COPY CURRENT GRANTS;
+-- GRANT OWNERSHIP
+-- 	ON ALL TASKS
+-- 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
+-- 	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ADMIN
+-- 	COPY CURRENT GRANTS;
 GRANT OWNERSHIP
 	ON ALL TASKS
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE.SYNAPSE_RAW_ALL_ADMIN
+	TO ROLE SYSADMIN
 	COPY CURRENT GRANTS;
 
 -- SCHEMACHANGE
@@ -625,21 +630,6 @@ GRANT OWNERSHIP
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
 	TO ROLE SYSADMIN
 	COPY CURRENT GRANTS;
-GRANT OWNERSHIP
-	ON ALL STAGES
-	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN
-	COPY CURRENT GRANTS;
-GRANT OWNERSHIP
-	ON ALL VIEWS
-	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN
-	COPY CURRENT GRANTS;
-GRANT OWNERSHIP
-	ON ALL TASKS
-	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_ALL_ADMIN
-	COPY CURRENT GRANTS;
 
 -- SYNAPSE_RAW
 GRANT OWNERSHIP
@@ -661,10 +651,15 @@ GRANT OWNERSHIP
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
 	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_ALL_ADMIN
 	COPY CURRENT GRANTS;
+-- GRANT OWNERSHIP
+-- 	ON ALL TASKS
+-- 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
+-- 	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_ALL_ADMIN
+-- 	COPY CURRENT GRANTS;
 GRANT OWNERSHIP
 	ON ALL TASKS
 	IN SCHEMA SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW
-	TO DATABASE ROLE SYNAPSE_DATA_WAREHOUSE_DEV.SYNAPSE_RAW_ALL_ADMIN
+	TO ROLE SYSADMIN
 	COPY CURRENT GRANTS;
 
 -- SCHEMACHANGE