Skip to content

Issue With Redshift Maintenance Window Changing Database Permissions

0

I'm encountering a weird bug(?) where some permissions are removed during the scheduled Redshift maintenance window. Specifically, read permissions I have granted on svv_table_info for a role are removed. Even more bizarre, this only happens on a subset of our databases in the cluster. I've searched for info on this but have come up empty-handed. Does anyone know what could be causing this and how to prevent it going forward?

asked 2 years ago206 views

1 Answer
0

The issue you're experiencing with Redshift permissions changing during the maintenance window is not a typical behavior for Amazon Redshift. Normally, database object permissions, once granted, should persist through maintenance windows. However, there are a few things to consider and investigate:

  1. Default Permissions: By default, only superusers and object owners have permissions on database objects. If the role you've granted permissions to is not the owner of the svv_table_info view, it's possible that some process is resetting permissions to their default state.

  2. Scoped Permissions: Redshift offers scoped permissions that apply to all current and future objects within a database or schema. If you're using scoped permissions, check if they're being applied correctly and consistently across all your databases.

  3. RBAC (Role-Based Access Control): If you're using RBAC, ensure that the role assignments and permissions are correctly set up and not being altered during maintenance.

  4. Superuser Actions: Check if there are any automated processes or scripts run by superusers that might be modifying permissions during or after the maintenance window.

  5. Verify Permissions: Use the SVV_DATABASE_PRIVILEGES view to check the current permissions on your databases. This can help you track changes in permissions over time.

To prevent this issue going forward:

  1. Document and regularly audit your permission settings.
  2. Use scoped permissions where appropriate to ensure consistent access across objects.
  3. Implement a process to reapply permissions after maintenance windows if the issue persists.
  4. Contact AWS support for further investigation, as this behavior is not expected and may indicate a deeper issue.

Remember, only superusers or users with the ACCESS SYSTEM TABLE permission can view all entries in SVV_DATABASE_PRIVILEGES. Other users can only see permissions for identities they have access to or own. This might be relevant when troubleshooting permission issues across different databases in your cluster.

Sources
Database object permissions - Amazon Redshift
Default database user permissions - Amazon Redshift
Scoped permissions - Amazon Redshift
SVV_DATABASE_PRIVILEGES - Amazon Redshift

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.