Introducing Role Based Access Control (RBAC) in Amazon Redshift | Amazon Web Services

This video introduces Role-based access control (RBAC) in Amazon Redshift and show how you can use Role-based access control (RBAC) to manage database privileges in Amazon Redshift.
Use roles to manage database privileges for your workload in Amazon Redshift.
Learn More - go.aws/37Gk6Mt
Subscribe:
More AWS videos - bit.ly/2O3zS75
More AWS events videos - bit.ly/316g9t4
ABOUT AWS
Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally. Millions of customers - including the fastest-growing startups, largest enterprises, and leading government agencies - are using AWS to lower costs, become more agile, and innovate faster.
#Amazon Redshift, #AWS, #Bigdata, #AWSAnalytics #AmazonWebServices #CloudComputing

[@deepaksenthilkumar9144]

I tested it out today. While the inheritance aspect is useful and good. Outside that, it's not really a feature that would be useful for us. What we would need are following main things: 1. ALTER DEFAULT PRIVILEGES should be at a ROLE/GROUP level instead of a user level in a schema as we want the role to govern the default privileges for objects in a set of schemas instead of defining it for each user. For example: ALTER DEFAULT PRIVILEGES FOR ROLE ABC in schema XYZ GRANT INSERT on tables to ROLE ABC; There by we can just add/drop user into a role or group without having to grant default privileges for every user added to the group/role. 2. GRANT TRUNCATE TABLE TO ALL tables IN SCHEMA XYZ TO ROLE ABC; We need the truncate table to be granular. We don't want to grant truncate to all the tables using a role. That's a security risk. We ended up building our own procs using a super user as security define and custom validations between user/schema to handle the truncate today. Ideally, truncate should a grantable permissions at user/role/group level to a table/schema. 3. GRANT ALTER TABLE TO ALL tables IN SCHEMA XYZ TO ROLE ABC; This doesn't exist, but the ability to alter a table and add/drop a column again depends on whether somebody is a owner of that object. We have created a procedure to take ownership of a table using our own proc (with custom validation based on user's group/schema where the operation is tried etc.) Also, I agree with Ben's comments. Above all, instead of adding hierarchy to the GROUP why was ROLE added. Is ROLE not redundant/duplicate with GROUP.

[@benimchen7]

This will make group redundant. Why was RBAC introduced instead of expanding the functions of group?

[@catquilt74]

This is a wonderful video and while RBAC is not perfect, it will help us implement a good level of security in our new data warehouse.

[@amazonwebservices]

Great to hear that & do share your feedback after implementation ! 🙌 😁

[@patbaker1497]

The example only has roles stacked in a linear pattern, not using one to many assignment. If user_1 is granted role_a, role_b and role_c does user_1 have the sum of permissions from granted roles which would be the same as using group membership to multiple groups?

[@patbaker1497]

By using roles you lose the ability to assign permissions through 'default privilege' for future created objects which seems to be a massive oversight in the roles implementation !! We have tables constantly being created and dropped in schemas with multiple groups assigned select permission. How can this be managed through roles?

[@neeharikachinimilli9720]

Could you let me know where does the permission denied errors will be stored ??

[@muhammadakif5083]

i have granted only select command while it is allowing user to create or drop table why is that

[@sajidsana3958]

We have implemented this role based machnisam 3 years back.

[@diwanharsh]

Hi Sajid, I am trying to create a role in redshift cluster but I get the error that "Create role is not enabled". My cluster is latest patch level. Is there anything that I need to do to enable RBAC? thanks

[@deepaksenthilkumar9144]

I am getting the same error too...

[@deepaksenthilkumar9144]

Ok, I see it's a new feature... repost.aws/questions/QUaxb-UYK3QXiFP7JHK6JO3Q/aws-redshift-maintenance-announcement-march-2nd-april-4th-2022 AWS Redshift Maintenance Announcement (March 2nd - April 4th 2022) | AWS re:Post **Major Version** **(03/02/2022)** We will be patching your Amazon Redshift clusters during your system maintenance window in the coming weeks. The timing of the patch will depend on your region ... Will test after we get the patch

[@adarshsonare9049]

How can we grant privilege to the azure AD federated redshift user ??

[@willianrocha8615]

great but we need group ownership to schema/table, not only the user.