79596927

Date: 2025-04-28 16:45:17
Score: 1
Natty:
Report link

When you run the ALTER DEFAULT PRIVILIGES statement, it only applies to objects created by the user who ran the command. If your table is getting recreated by a different user, then you need to run the command with the FOR USER clause. This will now target objects created by the specified user.

EX: I have schema_a.table_a, user_a, and user_b. Logged in as user_admin I ran the following to grant select privileges on table_a for user_a:

GRANT SELECT on schema_a.table_a TO user_a;

user_a now has select permissions as long as table_a is not recreated. If I want to maintain those permissions I could run something like this:

ALTER DEFAULT PRIVILEGES IN SCHEMA schema_a GRANT SELECT ON TABLES TO USER user_a;

However, this only applies to any tables created by my current logged in user user_admin. When an ETL process that uses user_b recreates the table, the privileges are lost. To achieve my desired behavior I would have to run the following:

ALTER DEFAULT PRIVILEGES FOR USER user_b IN SCHEMA schema_a GRANT SELECT ON TABLES TO USER user_a;

Now when user_b recreates the table user_a maintains their permissions.

AWS Docs: https://docs.aws.amazon.com/redshift/latest/dg/r_ALTER_DEFAULT_PRIVILEGES.html

Good blog post talking about this:
https://medium.com/@bob.pore/i-altered-my-redshift-schemas-default-privileges-why-can-t-my-users-query-my-new-tables-4a4daef11572

Reasons:
  • Blacklisted phrase (0.5): medium.com
  • RegEx Blacklisted phrase (1): I want
  • Long answer (-1):
  • Has code block (-0.5):
  • Starts with a question (0.5): When you
  • Low reputation (0.5):
Posted by: Mr. Spock