- Newest
- Most votes
- Most comments
The issue you're experiencing with Redshift permissions changing during the maintenance window is not a typical behavior for Amazon Redshift. Normally, database object permissions, once granted, should persist through maintenance windows. However, there are a few things to consider and investigate:
-
Default Permissions: By default, only superusers and object owners have permissions on database objects. If the role you've granted permissions to is not the owner of the svv_table_info view, it's possible that some process is resetting permissions to their default state.
-
Scoped Permissions: Redshift offers scoped permissions that apply to all current and future objects within a database or schema. If you're using scoped permissions, check if they're being applied correctly and consistently across all your databases.
-
RBAC (Role-Based Access Control): If you're using RBAC, ensure that the role assignments and permissions are correctly set up and not being altered during maintenance.
-
Superuser Actions: Check if there are any automated processes or scripts run by superusers that might be modifying permissions during or after the maintenance window.
-
Verify Permissions: Use the SVV_DATABASE_PRIVILEGES view to check the current permissions on your databases. This can help you track changes in permissions over time.
To prevent this issue going forward:
- Document and regularly audit your permission settings.
- Use scoped permissions where appropriate to ensure consistent access across objects.
- Implement a process to reapply permissions after maintenance windows if the issue persists.
- Contact AWS support for further investigation, as this behavior is not expected and may indicate a deeper issue.
Remember, only superusers or users with the ACCESS SYSTEM TABLE permission can view all entries in SVV_DATABASE_PRIVILEGES. Other users can only see permissions for identities they have access to or own. This might be relevant when troubleshooting permission issues across different databases in your cluster.
Sources
Database object permissions - Amazon Redshift
Default database user permissions - Amazon Redshift
Scoped permissions - Amazon Redshift
SVV_DATABASE_PRIVILEGES - Amazon Redshift
answered 2 years ago
Relevant content
asked a year ago
