Revoke CREATE STAGE privilege on a snowflake role

user_6329390 0
Viewed 291

I setup a new role called 'TEST_CLIENT_ROLE' and Granted USAGE and CREATE SCHEMA on a database called TEST_CLIENT_DB. I didnt grant any explicit permissions to CREATE STAGE on this database or schema. But still user belonging to the role is able to create stage.

I also explicitly revoke CREATE STAGE on the role like below

REVOKE CREATE STAGE ON ALL SCHEMAS IN DATABASE TEST_CLIENT_DB FROM ROLE TEST_CLIENT_ROLE;
REVOKE CREATE STAGE ON FUTURE SCHEMAS IN DATABASE TEST_CLIENT_DB FROM ROLE TEST_CLIENT_ROLE;

But still the user in that role is able to create stage under that database schema.

Can someone help me out in figuring how to make sure that a role cant create stage under a database/schema

snowflake-schema snowflake-cloud-data-platform roles authorization permissions
1 Answers

Snowflake roles inherit permissions from child roles. If this role is the parent of another role with this permission, you need to revoke the permission from the child role. Also, object owners have pretty much full permissions so if the role is the owner, I don't think you can revoke the permission

user_141005830
Related