From 2c851fcef891da220839494309810c2c55ee36ce Mon Sep 17 00:00:00 2001 From: Tiji Mathew Date: Sun, 14 Apr 2024 17:22:10 -0400 Subject: [PATCH] Updating demo scripts --- .github/workflows/dev-pytest.yml | 3 +- demo/citibike/schemachange-config.yml | 2 +- demo/citibike_jinja/schemachange-config.yml | 17 +++- .../V1.1__initial_database_objects.sql | 4 +- .../scripts/V1.2__load_tables_from_s3.sql | 5 +- demo/provision/initialize.sql | 47 +++++++++++ demo/provision/setup_schemachange_schema.sql | 65 +++++++++++++++ demo/setup/setup_citibike_demo.sql | 83 +++++++++++++++++++ demo/setup/setup_citibike_demo_jinja.sql | 83 +++++++++++++++++++ demo/teardown/teardown_citibike_demo.sql | 15 ++++ 10 files changed, 315 insertions(+), 9 deletions(-) create mode 100644 demo/provision/initialize.sql create mode 100644 demo/provision/setup_schemachange_schema.sql create mode 100644 demo/setup/setup_citibike_demo.sql create mode 100644 demo/setup/setup_citibike_demo_jinja.sql create mode 100644 demo/teardown/teardown_citibike_demo.sql diff --git a/.github/workflows/dev-pytest.yml b/.github/workflows/dev-pytest.yml index 3cc7907e..dcbe686c 100644 --- a/.github/workflows/dev-pytest.yml +++ b/.github/workflows/dev-pytest.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-latest strategy: fail-fast: false - + steps: - uses: actions/checkout@v4 - name: Set up Python ${{ matrix.python-version }} @@ -43,5 +43,6 @@ jobs: - name: Test Citibike Demo run: | schemachange --config-folder ./demo/citibike + schemachange --config-folder ./demo/citibike_jinja - name: Teardown Citibike Demo run: echo "Cleaning up Citibike Demo" diff --git a/demo/citibike/schemachange-config.yml b/demo/citibike/schemachange-config.yml index fe81889a..8bfd7aeb 100644 --- a/demo/citibike/schemachange-config.yml +++ b/demo/citibike/schemachange-config.yml @@ -8,6 +8,6 @@ snowflake-role: SCHEMACHANGE_DEMO_DEPLOY snowflake-warehouse: SCHEMACHANGE_DEMO_WH snowflake-database: SCHEMACHANGE_DEMO snowflake-schema: CITIBIKE_DEMO -change-history-table: "SCHEMACHANGE_DEMO.SCHEMACHANGE.CHANGE_HISTORY" +change-history-table: "SCHEMACHANGE_DEMO.SCHEMACHANGE.CITIBIKE_DEMO_CHANGE_HISTORY" create-change-history-table: true diff --git a/demo/citibike_jinja/schemachange-config.yml b/demo/citibike_jinja/schemachange-config.yml index 0a028a20..b370017e 100644 --- a/demo/citibike_jinja/schemachange-config.yml +++ b/demo/citibike_jinja/schemachange-config.yml @@ -1,9 +1,20 @@ config-version: 1 -root-folder: scripts -modules-folder: modules +root-folder: ./demo/citibike_jinja/scripts +modules-folder: ./demo/citibike_jinja/modules + +snowflake-user: {{ env_var('SNOWFLAKE_USER')}} +snowflake-account: {{ env_var('SNOWFLAKE_ACCOUNT')}} +snowflake-role: SCHEMACHANGE_DEMO_DEPLOY +snowflake-warehouse: SCHEMACHANGE_DEMO_WH +snowflake-database: SCHEMACHANGE_DEMO +snowflake-schema: CITIBIKE_DEMO_JINJA +change-history-table: "SCHEMACHANGE_DEMO.SCHEMACHANGE.CITIBIKE_DEMO_JNJA_CHANGE_HISTORY" +create-change-history-table: true + vars: - database_name: {{env_var('SF_DATABASE', 'SCHEMACHANGE_DEMO_JINJA')}} + database_name: {{env_var('SNOWFLAKE_DATABASE', 'SCHEMACHANGE_DEMO')}} + schema_name: {{env_var('SNOWFLAKE_SCHEMA', 'CITIBIKE_DEMO_JINJA')}} secrets: # not a good example of secrets, just here to demo the secret filtering trips_s3_bucket: s3://snowflake-workshop-lab/citibike-trips diff --git a/demo/citibike_jinja/scripts/V1.1__initial_database_objects.sql b/demo/citibike_jinja/scripts/V1.1__initial_database_objects.sql index 83ff91be..78ff925f 100644 --- a/demo/citibike_jinja/scripts/V1.1__initial_database_objects.sql +++ b/demo/citibike_jinja/scripts/V1.1__initial_database_objects.sql @@ -1,9 +1,9 @@ {% from 'modules/create_stage.j2' import create_stage-%} -- Create the database if it doesn't exist -CREATE DATABASE IF NOT EXISTS {{database_name}}; +USE DATABASE {{database_name}}; -- Set the database and schema context -USE SCHEMA {{database_name}}.PUBLIC; +USE SCHEMA {{database_name}}.{{schema_name}}; -- Create the file formats CREATE OR REPLACE FILE FORMAT CSV_NO_HEADER diff --git a/demo/citibike_jinja/scripts/V1.2__load_tables_from_s3.sql b/demo/citibike_jinja/scripts/V1.2__load_tables_from_s3.sql index bd0cdcf4..0682ef40 100644 --- a/demo/citibike_jinja/scripts/V1.2__load_tables_from_s3.sql +++ b/demo/citibike_jinja/scripts/V1.2__load_tables_from_s3.sql @@ -1,9 +1,10 @@ -- Set the database and schema context -USE SCHEMA {{database_name}}.PUBLIC; +USE SCHEMA {{database_name}}.{{schema_name}}; -- Load the trips data COPY INTO TRIPS FROM @TRIPS - FILE_FORMAT = (FORMAT_NAME = 'CSV_NO_HEADER'); + FILE_FORMAT = (FORMAT_NAME = 'CSV_NO_HEADER') + PATTERN = '.*trips_.*csv.gz'; -- Load the weather data COPY INTO WEATHER FROM diff --git a/demo/provision/initialize.sql b/demo/provision/initialize.sql new file mode 100644 index 00000000..53bf1006 --- /dev/null +++ b/demo/provision/initialize.sql @@ -0,0 +1,47 @@ +-- This script is provided as a sample setup to use database roles, warehouse, admin role, deploy role as an example. +-- YOu may choose to have your own RBAC and SCHEMACHANGE database setup depending on your organization objectives. +-- Set these to personalize your deployment +SET SERVICE_USER_PASSWORD = 'CHANGEME'; +SET ADMIN_USER = 'CHANGEME'; +SET TARGET_DB_NAME = 'SCHEMACHANGE_DEMO'; -- Name of database that will have the SCHEMACHANGE Schema for change tracking. + +-- Dependent Variables; Change the naming pattern if you want but not necessary +SET ADMIN_ROLE = $TARGET_DB_NAME || '_ADMIN'; -- This role will own the database and schemas. +SET DEPLOY_ROLE = $TARGET_DB_NAME || '_DEPLOY'; -- This role will be granted privileges to create objects in any schema in the database +SET SERVICE_USER = $TARGET_DB_NAME || '_SVC_USER'; -- This user will be granted the Deploy role. +SET WAREHOUSE_NAME = $TARGET_DB_NAME || '_WH'; +SET AC_U = '_AC_U_' || $WAREHOUSE_NAME; +SET AC_O = '_AC_O_' || $WAREHOUSE_NAME; + +USE ROLE USERADMIN; +-- Service user used to run SCHEMACHANGE deployments +CREATE USER IF NOT EXISTS IDENTIFIER($SERVICE_USER) WITH PASSWORD=$SERVICE_USER_PASSWORD MUST_CHANGE_PASSWORD=FALSE; +-- Role granted to a human user to manage the database permissions and database roles. +CREATE ROLE IF NOT EXISTS IDENTIFIER($ADMIN_ROLE); +CREATE ROLE IF NOT EXISTS IDENTIFIER($DEPLOY_ROLE); +CREATE ROLE IF NOT EXISTS IDENTIFIER($AC_U); +CREATE ROLE IF NOT EXISTS IDENTIFIER($AC_O); +GRANT ROLE IDENTIFIER($AC_U) TO ROLE IDENTIFIER($AC_O); + + +-- Role hierarchy tied to SYSADMIN; +USE ROLE SECURITYADMIN; +GRANT ROLE IDENTIFIER($DEPLOY_ROLE) TO ROLE IDENTIFIER($ADMIN_ROLE); +GRANT ROLE IDENTIFIER($ADMIN_ROLE) TO ROLE SYSADMIN; + +GRANT ROLE IDENTIFIER($DEPLOY_ROLE) TO USER IDENTIFIER($SERVICE_USER); +GRANT ROLE IDENTIFIER($ADMIN_ROLE) TO USER IDENTIFIER($ADMIN_USER); + +USE ROLE SYSADMIN; +CREATE DATABASE IF NOT EXISTS IDENTIFIER($TARGET_DB_NAME); + +USE ROLE SECURITYADMIN; +GRANT OWNERSHIP ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO ROLE IDENTIFIER($ADMIN_ROLE) WITH GRANT OPTION; + +USE ROLE SYSADMIN; +CREATE WAREHOUSE IF NOT EXISTS IDENTIFIER($WAREHOUSE_NAME); +USE ROLE SECURITYADMIN; +GRANT OWNERSHIP ON WAREHOUSE IDENTIFIER($WAREHOUSE_NAME) TO ROLE IDENTIFIER($ADMIN_ROLE) WITH GRANT OPTION; +GRANT USAGE ON WAREHOUSE IDENTIFIER($WAREHOUSE_NAME) TO ROLE IDENTIFIER($AC_U); +GRANT OPERATE ON WAREHOUSE IDENTIFIER($WAREHOUSE_NAME) TO ROLE IDENTIFIER($AC_O); +GRANT ROLE IDENTIFIER($AC_U) TO ROLE IDENTIFIER($DEPLOY_ROLE); \ No newline at end of file diff --git a/demo/provision/setup_schemachange_schema.sql b/demo/provision/setup_schemachange_schema.sql new file mode 100644 index 00000000..b0363a4a --- /dev/null +++ b/demo/provision/setup_schemachange_schema.sql @@ -0,0 +1,65 @@ +SET TARGET_SCHEMA_NAME = 'SCHEMACHANGE'; +SET TARGET_DB_NAME = 'SCHEMACHANGE_DEMO'; -- Name of database that will have the SCHEMACHANGE Schema for change tracking. +-- Dependent Variables; Change the naming pattern if you want but not necessary +SET ADMIN_ROLE = $TARGET_DB_NAME || '_ADMIN'; -- This role will own the database and schemas. +SET DEPLOY_ROLE = $TARGET_DB_NAME || '_DEPLOY'; -- This role will be granted privileges to create objects in any schema in the database +SET WAREHOUSE_NAME = $TARGET_DB_NAME || '_WH'; +SET SCHEMACHANGE_NAMESPACE = $TARGET_DB_NAME || '.' || $TARGET_SCHEMA_NAME; +SET SC_M = 'SC_M_' || $TARGET_SCHEMA_NAME; +SET SC_R = 'SC_R_' || $TARGET_SCHEMA_NAME; +SET SC_W = 'SC_W_' || $TARGET_SCHEMA_NAME; +SET SC_C = 'SC_C_' || $TARGET_SCHEMA_NAME; + +USE ROLE IDENTIFIER($ADMIN_ROLE); +USE DATABASE IDENTIFIER($TARGET_DB_NAME); +USE WAREHOUSE IDENTIFIER($WAREHOUSE_NAME); + +CREATE DATABASE ROLE IF NOT EXISTS DB_M; +CREATE DATABASE ROLE IF NOT EXISTS DB_R; +CREATE DATABASE ROLE IF NOT EXISTS DB_W; +CREATE DATABASE ROLE IF NOT EXISTS DB_C; + +GRANT DATABASE ROLE DB_C TO ROLE IDENTIFIER($DEPLOY_ROLE); + +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_M); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_R); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_W); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_C); + +GRANT DATABASE ROLE IDENTIFIER($SC_M) TO DATABASE ROLE DB_M; +GRANT DATABASE ROLE IDENTIFIER($SC_R) TO DATABASE ROLE DB_R; +GRANT DATABASE ROLE IDENTIFIER($SC_W) TO DATABASE ROLE DB_W; +GRANT DATABASE ROLE IDENTIFIER($SC_C) TO DATABASE ROLE DB_C; +GRANT DATABASE ROLE IDENTIFIER($SC_M) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT DATABASE ROLE IDENTIFIER($SC_R) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT DATABASE ROLE IDENTIFIER($SC_W) TO DATABASE ROLE IDENTIFIER($SC_C); + +CREATE SCHEMA IF NOT EXISTS IDENTIFIER($TARGET_SCHEMA_NAME) WITH MANAGED ACCESS; +-- USE SCHEMA INFORMATION_SCHEMA; +-- DROP SCHEMA IF EXISTS PUBLIC; + +USE SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE); +-- SCHEMA +-- SC_M +GRANT USAGE ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT MONITOR ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT MONITOR ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +-- None +-- SC_C +GRANT MODIFY, APPLYBUDGET, ADD SEARCH OPTIMIZATION ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + +-- TABLES +-- SC_M +GRANT REFERENCES ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT REFERENCES ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT SELECT ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT SELECT ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +GRANT INSERT, UPDATE, DELETE, TRUNCATE, EVOLVE SCHEMA ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT INSERT, UPDATE, DELETE, TRUNCATE, EVOLVE SCHEMA ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +-- SC_C +GRANT CREATE TABLE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); \ No newline at end of file diff --git a/demo/setup/setup_citibike_demo.sql b/demo/setup/setup_citibike_demo.sql new file mode 100644 index 00000000..e9fe5a87 --- /dev/null +++ b/demo/setup/setup_citibike_demo.sql @@ -0,0 +1,83 @@ +SET TARGET_SCHEMA_NAME = 'CITIBIKE_DEMO'; +SET TARGET_DB_NAME = 'SCHEMACHANGE_DEMO'; -- Name of database that will have the SCHEMACHANGE Schema for change tracking. +-- Dependent Variables; Change the naming pattern if you want but not necessary +SET ADMIN_ROLE = $TARGET_DB_NAME || '_ADMIN'; -- This role will own the database and schemas. +SET DEPLOY_ROLE = $TARGET_DB_NAME || '_DEPLOY'; -- This role will be granted privileges to create objects in any schema in the database +SET WAREHOUSE_NAME = $TARGET_DB_NAME || '_WH'; +SET SCHEMACHANGE_NAMESPACE = $TARGET_DB_NAME || '.' || $TARGET_SCHEMA_NAME; +SET SC_M = 'SC_M_' || $TARGET_SCHEMA_NAME; +SET SC_R = 'SC_R_' || $TARGET_SCHEMA_NAME; +SET SC_W = 'SC_W_' || $TARGET_SCHEMA_NAME; +SET SC_C = 'SC_C_' || $TARGET_SCHEMA_NAME; + +USE ROLE IDENTIFIER($ADMIN_ROLE); +USE DATABASE IDENTIFIER($TARGET_DB_NAME); +USE WAREHOUSE IDENTIFIER($WAREHOUSE_NAME); + +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_M); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_R); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_W); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_C); + +GRANT DATABASE ROLE IDENTIFIER($SC_M) TO DATABASE ROLE DB_M; +GRANT DATABASE ROLE IDENTIFIER($SC_R) TO DATABASE ROLE DB_R; +GRANT DATABASE ROLE IDENTIFIER($SC_W) TO DATABASE ROLE DB_W; +GRANT DATABASE ROLE IDENTIFIER($SC_C) TO DATABASE ROLE DB_C; +GRANT DATABASE ROLE IDENTIFIER($SC_M) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT DATABASE ROLE IDENTIFIER($SC_R) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT DATABASE ROLE IDENTIFIER($SC_W) TO DATABASE ROLE IDENTIFIER($SC_C); + +CREATE SCHEMA IF NOT EXISTS IDENTIFIER($TARGET_SCHEMA_NAME) WITH MANAGED ACCESS; +-- USE SCHEMA INFORMATION_SCHEMA; +-- DROP SCHEMA IF EXISTS PUBLIC; + +USE SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE); +-- SCHEMA +-- SC_M +GRANT USAGE ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT MONITOR ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT MONITOR ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +-- None +-- SC_C +GRANT MODIFY, APPLYBUDGET, ADD SEARCH OPTIMIZATION ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + +-- TABLES +-- SC_M +GRANT REFERENCES ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT REFERENCES ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT SELECT ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT SELECT ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +GRANT INSERT, UPDATE, DELETE, TRUNCATE, EVOLVE SCHEMA ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT INSERT, UPDATE, DELETE, TRUNCATE, EVOLVE SCHEMA ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +-- SC_C +GRANT CREATE TABLE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + +-- STAGES +-- SC_M +GRANT USAGE ON ALL STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON FUTURE STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT READ ON ALL STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT READ ON FUTURE STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +GRANT READ,WRITE ON ALL STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT READ,WRITE ON FUTURE STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +-- SC_C +GRANT CREATE STAGE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + + +-- FILE FORMATS +-- SC_M +GRANT USAGE ON ALL FILE FORMATS IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON FUTURE FILE FORMATS IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +-- N/A +-- SC_W +-- N/A +-- SC_C +GRANT CREATE FILE FORMAT ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); \ No newline at end of file diff --git a/demo/setup/setup_citibike_demo_jinja.sql b/demo/setup/setup_citibike_demo_jinja.sql new file mode 100644 index 00000000..9fd40a6c --- /dev/null +++ b/demo/setup/setup_citibike_demo_jinja.sql @@ -0,0 +1,83 @@ +SET TARGET_SCHEMA_NAME = 'CITIBIKE_DEMO_JINJA'; +SET TARGET_DB_NAME = 'SCHEMACHANGE_DEMO'; -- Name of database that will have the SCHEMACHANGE Schema for change tracking. +-- Dependent Variables; Change the naming pattern if you want but not necessary +SET ADMIN_ROLE = $TARGET_DB_NAME || '_ADMIN'; -- This role will own the database and schemas. +SET DEPLOY_ROLE = $TARGET_DB_NAME || '_DEPLOY'; -- This role will be granted privileges to create objects in any schema in the database +SET WAREHOUSE_NAME = $TARGET_DB_NAME || '_WH'; +SET SCHEMACHANGE_NAMESPACE = $TARGET_DB_NAME || '.' || $TARGET_SCHEMA_NAME; +SET SC_M = 'SC_M_' || $TARGET_SCHEMA_NAME; +SET SC_R = 'SC_R_' || $TARGET_SCHEMA_NAME; +SET SC_W = 'SC_W_' || $TARGET_SCHEMA_NAME; +SET SC_C = 'SC_C_' || $TARGET_SCHEMA_NAME; + +USE ROLE IDENTIFIER($ADMIN_ROLE); +USE DATABASE IDENTIFIER($TARGET_DB_NAME); +USE WAREHOUSE IDENTIFIER($WAREHOUSE_NAME); + +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_M); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_R); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_W); +CREATE DATABASE ROLE IF NOT EXISTS IDENTIFIER($SC_C); + +GRANT DATABASE ROLE IDENTIFIER($SC_M) TO DATABASE ROLE DB_M; +GRANT DATABASE ROLE IDENTIFIER($SC_R) TO DATABASE ROLE DB_R; +GRANT DATABASE ROLE IDENTIFIER($SC_W) TO DATABASE ROLE DB_W; +GRANT DATABASE ROLE IDENTIFIER($SC_C) TO DATABASE ROLE DB_C; +GRANT DATABASE ROLE IDENTIFIER($SC_M) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT DATABASE ROLE IDENTIFIER($SC_R) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT DATABASE ROLE IDENTIFIER($SC_W) TO DATABASE ROLE IDENTIFIER($SC_C); + +CREATE SCHEMA IF NOT EXISTS IDENTIFIER($TARGET_SCHEMA_NAME) WITH MANAGED ACCESS; +-- USE SCHEMA INFORMATION_SCHEMA; +-- DROP SCHEMA IF EXISTS PUBLIC; + +USE SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE); +-- SCHEMA +-- SC_M +GRANT USAGE ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT MONITOR ON DATABASE IDENTIFIER($TARGET_DB_NAME) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT MONITOR ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +-- None +-- SC_C +GRANT MODIFY, APPLYBUDGET, ADD SEARCH OPTIMIZATION ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + +-- TABLES +-- SC_M +GRANT REFERENCES ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT REFERENCES ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT SELECT ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT SELECT ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +GRANT INSERT, UPDATE, DELETE, TRUNCATE, EVOLVE SCHEMA ON ALL TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT INSERT, UPDATE, DELETE, TRUNCATE, EVOLVE SCHEMA ON FUTURE TABLES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +-- SC_C +GRANT CREATE TABLE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + +-- STAGES +-- SC_M +GRANT USAGE ON ALL STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON FUTURE STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +GRANT READ ON ALL STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +GRANT READ ON FUTURE STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_R); +-- SC_W +GRANT READ,WRITE ON ALL STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +GRANT READ,WRITE ON FUTURE STAGES IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_W); +-- SC_C +GRANT CREATE STAGE ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); + + +-- FILE FORMATS +-- SC_M +GRANT USAGE ON ALL FILE FORMATS IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +GRANT USAGE ON FUTURE FILE FORMATS IN SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_M); +-- SC_R +-- N/A +-- SC_W +-- N/A +-- SC_C +GRANT CREATE FILE FORMAT ON SCHEMA IDENTIFIER($SCHEMACHANGE_NAMESPACE) TO DATABASE ROLE IDENTIFIER($SC_C); \ No newline at end of file diff --git a/demo/teardown/teardown_citibike_demo.sql b/demo/teardown/teardown_citibike_demo.sql new file mode 100644 index 00000000..58ebc1eb --- /dev/null +++ b/demo/teardown/teardown_citibike_demo.sql @@ -0,0 +1,15 @@ +SET TARGET_DB_NAME = 'SCHEMACHANGE_DEMO'; -- Name of database that will have the SCHEMACHANGE Schema for change tracking. + +-- Dependent Variables; Change the naming pattern if you want but not necessary +SET ADMIN_ROLE = $TARGET_DB_NAME || '_ADMIN'; -- This role will own the database and schemas. +SET DEPLOY_ROLE = $TARGET_DB_NAME || '_DEPLOY'; -- This role will be granted privileges to create objects in any schema in the database +SET SERVICE_USER = $TARGET_DB_NAME || '_SVC_USER'; -- This user will be granted the Deploy role. +SET WAREHOUSE_NAME = $TARGET_DB_NAME || '_WH'; +SET AC_U = '_AC_U_' || $WAREHOUSE_NAME; +SET AC_O = '_AC_O_' || $WAREHOUSE_NAME; + +USE ROLE IDENTIFIER($ADMIN_ROLE); + +DROP DATABASE IF EXISTS IDENTIFIER($TARGET_DB_NAME); +DROP WAREHOUSE IF EXISTS IDENTIFIER($WAREHOUSE_NAME); +