1
votes

A non-superuser needs to get permission to execute catalog queries on certain system tables in a Redshift DB (multiple schemas) as per https://docs.aws.amazon.com/redshift/latest/dg/c_join_PG_examples.html.

What the user should be able to do is see all schemas, tables and columns within a database, in order to essentially tell if the modified_date column of each table, has been updated in the daily ETL.

Looking at documentation, it looks like setting alter user SYSLOG ACCESS UNRESTRICTED as per https://docs.aws.amazon.com/redshift/latest/dg/c_visibility-of-data.html looks like an option, is it sufficient?

Or perhaps I can do grant all on pg_catalog.pg_class to user and so forth for all the necessary system tables mentioned above?

Any help is greatly appreciated!

1

1 Answers

2
votes

SYSLOG ACCESS UNRESTRICTED will allow your user to query all the system catalog tables, but for some system tables like PG_TABLE_DEF they may also need to ensure that their search_path includes the schemas they are interested in.