Fine-grained access control via database roles

Patent metadata

Field	Value
Publication number	US-11822689-B2
Application number	US-202318109191-A
Country	US
Kind code	B2
Filing date	Feb 13, 2023
Priority date	Aug 26, 2021
Publication date	Nov 21, 2023
Grant date	Nov 21, 2023

Abstract

Embodiments of the present disclosure relate to sharing database roles using hidden roles. A database role may be generated within a database container having a plurality of data objects, wherein the database role exists exclusively within the database container. A set of grants to a particular subset of the plurality of data objects of the database container may be assigned to the database role and the database role may be granted to the share object. The share object is mounted within a consumer account to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role. The imported copy of the database role may be granted to each of one or more account level roles of the consumer account to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

First claim

What is claimed is:

1. A method comprising:
generating, within a database container of a provider account, a database role comprising an object that is separate from any of a plurality of objects the database container is comprised of;
assigning to the database role, a set of grants to a particular subset of the plurality of data objects of the database container;
granting the database role to a share object;
mounting within a consumer account, the share object to which the database role has been granted to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role; and
granting, to each of one or more account level roles of the consumer account, the imported copy of the database role to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

2. The method of claim 1 , wherein granting the database role to the share object comprises:
creating a hidden role having no identifier;
granting the database role to the hidden role; and
granting the hidden role to the share object.

3. The method of claim 1 , further comprising:
updating the database container with an additional object; and
assigning to a second database role, a grant to the additional object, wherein the additional object is immediately available to an account level role of the consumer account to which an imported copy of the second database role is granted.

4. The method of claim 3 , wherein no new objects are created by the consumer account in response to the additional object being added to the database container.

5. The method of claim 1 , wherein the imported database container may access the particular subset of the plurality of data objects assigned to the database role and each of the one or more account level roles of the consumer account may access the particular subset of the plurality of data objects via the imported copy of the database role.

6. The method of claim 1 , wherein the database role does not include grants to objects outside of the database container.

7. The method of claim 1 , further comprising:
granting the database role to the share object.

8. The method of claim 1 , wherein the hidden role comprises a database role or an account level role.

9. A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
generate, within a database container of a provider account, a database role comprising an object that is separate from any of a plurality of objects the database container is comprised of;
assign to the database role, a set of grants to a particular subset of the plurality of data objects of the database container;
grant the database role to a share object;
mount within a consumer account, the share object to which the database role has been granted to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role; and
grant, to each of one or more account level roles of the consumer account, the imported copy of the database role to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

10. The system of claim 9 , wherein to grant the database role to the share object, the processing device is to:
create a hidden role having no identifier;
grant the database role to the hidden role; and
grant the hidden role to the share object.

11. The system of claim 9 , wherein the processing device is further to:
update the database container with an additional object; and
assign to a second database role, a grant to the additional object, wherein the additional object is immediately available to an account level role of the consumer account to which an imported copy of the second database role is granted.

12. The system of claim 11 , wherein no new objects are created by the consumer account in response to the additional object being added to the database container.

13. The system of claim 9 , wherein the imported database container may access the particular subset of the plurality of data objects assigned to the database role and each of the one or more account level roles of the consumer account may access the particular subset of the plurality of data objects via the imported copy of the database role.

14. The system of claim 9 , wherein the database role does not include grants to objects outside of the database container.

15. The system of claim 9 , wherein the processing device is further to:
grant the database role to the share object.

16. The system of claim 9 , wherein the hidden role comprises a database role or an account level role.

17. A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device cause the processing device to:
generate, within a database container of a provider account, a database role comprising an object that is separate from any of a plurality of objects the database container is comprised of;
assign to the database role, a set of grants to a particular subset of the plurality of data objects of the database container;
grant the database role to a share object;
mount within a consumer account, the share object to which the database role has been granted to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role; and
grant, to each of one or more account level roles of the consumer account, the imported copy of the database role to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

18. The non-transitory computer-readable medium of claim 17 , wherein to grant the database role to the share object, the processing device is to:
create a hidden role having no identifier;
grant the database role to the hidden role; and
grant the hidden role to the share object.

19. The non-transitory computer-readable medium of claim 17 , wherein the processing device is further to:
update the database container with an additional object; and
assign to a second database role, a grant to the additional object, wherein the additional object is immediately available to an account level role of the consumer account to which an imported copy of the second database role is granted.

20. The non-transitory computer-readable medium of claim 19 , wherein no new objects are created by the consumer account in response to the additional object being added to the database container.

21. The non-transitory computer-readable medium of claim 17 , wherein the imported database container may access the particular subset of the plurality of data objects assigned to the database role and each of the one or more account level roles of the consumer account may access the particular subset of the plurality of data objects via the imported copy of the database role.

22. The non-transitory computer-readable medium of claim 17 , wherein the database role does not include grants to objects outside of the database container.

23. The non-transitory computer-readable medium of cl

Assignees

• Snowflake Inc

Inventors

• Carru Damien
• Chu Pui Kei Johnston
• Dageville Benoit
• Desai Shreyas Narendra
• Muralidhar Subramanian
• Zhang Bowen

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/21

  Design, administration or maintenance of databases · CPC title

• G06F16/256

  in federated or virtual databases · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title