数据仓库服务 GAUSSDB(DWS)-CREATE ROW LEVEL SECURITY POLICY:示例2:通过行级控制实现分区权限管理

时间:2024-12-06 15:12:41

示例2:通过行级控制实现分区权限管理

  1. 创建用户alice:
    1
    CREATE ROLE alice PASSWORD '{password1}';
    
  2. 创建范围分区表web_returns_p1,并插入数据:
     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    13
    14
    15
    16
    CREATE TABLE web_returns_p1
    (
        wr_returned_date_sk       integer,
        wr_returned_time_sk       integer,
        wr_item_sk                integer NOT NULL,
        wr_refunded_customer_sk   integer
    )
    WITH (orientation = column)
    DISTRIBUTE BY HASH (wr_item_sk)
    PARTITION BY RANGE(wr_returned_date_sk)
    (
        PARTITION p2016 START(800) END(830) EVERY(1)
    );
    
    INSERT INTO web_returns_p1 values (801,17,11,102);
    INSERT INTO web_returns_p1 values (802,18,12,103);
    
  3. 将表web_returns_p1的读取权限赋予alice用户:
    1
    GRANT SELECT ON web_returns_p1 TO alice;
    
  4. 打开行访问控制策略开关:
    1
    ALTER TABLE web_returns_p1 ENABLE ROW LEVEL SECURITY;
    
  5. 创建行级访问控制策略web_returns_rsl。其中wr_returned_date_sk为web_returns_p1分区表的分区名,801为分区值:
    1
    CREATE ROW LEVEL SECURITY POLICY web_returns_rsl ON web_returns_p1 USING('wr_returned_date_sk' = '801');
    
  6. 将行级访问控制策略web_returns_rsl的赋予用户alice:
    1
    ALTER ROW LEVEL SECURITY POLICY web_returns_rsl ON web_returns_p1 TO alice;
    
  7. 切换至alice用户:
    1
    set role alice password '{password1}';
    
  8. 查询表web_returns_p1:
    1
    select * from web_returns_p1;
    
support.huaweicloud.com/sqlreference-910-dws/dws_06_0169.html