When you run the ALTER DEFAULT PRIVILIGES
statement, it only applies to objects created by the user who ran the command. If your table is getting recreated by a different user, then you need to run the command with the FOR USER
clause. This will now target objects created by the specified user.
EX: I have schema_a.table_a
, user_a
, and user_b
. Logged in as user_admin
I ran the following to grant select privileges on table_a
for user_a
:
GRANT SELECT on schema_a.table_a TO user_a;
user_a
now has select permissions as long as table_a
is not recreated. If I want to maintain those permissions I could run something like this:
ALTER DEFAULT PRIVILEGES IN SCHEMA schema_a GRANT SELECT ON TABLES TO USER user_a;
However, this only applies to any tables created by my current logged in user user_admin
. When an ETL process that uses user_b
recreates the table, the privileges are lost. To achieve my desired behavior I would have to run the following:
ALTER DEFAULT PRIVILEGES FOR USER user_b IN SCHEMA schema_a GRANT SELECT ON TABLES TO USER user_a;
Now when user_b
recreates the table user_a
maintains their permissions.
AWS Docs: https://docs.aws.amazon.com/redshift/latest/dg/r_ALTER_DEFAULT_PRIVILEGES.html
Good blog post talking about this:
https://medium.com/@bob.pore/i-altered-my-redshift-schemas-default-privileges-why-can-t-my-users-query-my-new-tables-4a4daef11572