Database permissions
Understand the permissions that can be assigned at the database level in Firebolt, including controlling access to database objects and managing database-level operations.
In Firebolt, a database is a logical container that organizes your data warehouse by holding components such as tables, views, indexes, and other database objects, as shown in the following diagram:
Database-level permissions define what actions roles can perform within a database and its associated objects.
Database-level privileges
| Privilege | Description | GRANT Syntax | REVOKE Syntax |
|---|---|---|---|
| USAGE | Allows access to the database and enables attaching engines to it. | GRANT USAGE ON DATABASE <database_name> TO <role>; | REVOKE USAGE ON DATABASE <database_name> FROM <role>; |
| MODIFY | Allows altering database properties and dropping the database. | GRANT MODIFY ON DATABASE <database_name> TO <role>; | REVOKE MODIFY ON DATABASE <database_name> FROM <role>; |
| USAGE ANY SCHEMA | Allows access to all current and future schemas within the database. | GRANT USAGE ANY SCHEMA ON DATABASE <database_name> TO <role>; | REVOKE USAGE ANY SCHEMA ON DATABASE <database_name> FROM <role>; |
| VACUUM ANY | Allows running the VACUUM operation on all current and future tables. | GRANT VACUUM ANY ON DATABASE <database_name> TO <role>; | REVOKE VACUUM ANY ON DATABASE <database_name> FROM <role>; |
| ALL [PRIVILEGES] | Grants all direct privileges over the database to a role. | GRANT ALL ON DATABASE <database_name> TO <role>; | REVOKE ALL ON DATABASE <database_name> FROM <role>; |
Examples of granting database permissions
USAGE permission
The following code example grants the role developer_role access to use the specified database:
MODIFY permission
The following code example gives the role developer_role permission to alter properties or drop the specified database:
USAGE ANY SCHEMA permission
The following code example grants the role developer_role access to all current and future schemas within the specified database:
VACUUM ANY permission
The following code example gives the role developer_role permission to run VACUUM operations on all current and future tables in the specified database:
ALL permissions
The following code example gives the role developer_role all the direct permissions over database database-1: