数据仓库服务 GAUSSDB(DWS)-CREATE ROW LEVEL SECURITY POLICY:示例

时间:2024-09-05 10:32:36

示例

创建用户alice:

1
CREATE ROLE alice PASSWORD '{Password}';

创建用户bob:

1
CREATE ROLE bob PASSWORD '{Password}';

创建数据表public.all_data:

1
CREATE TABLE public.all_data(id int, role varchar(100), data varchar(100));

向数据表插入数据:

1
2
3
INSERT INTO all_data VALUES(1, 'alice', 'alice data');
INSERT INTO all_data VALUES(2, 'bob', 'bob data');
INSERT INTO all_data VALUES(3, 'peter', 'peter data');

将表all_data的读取权限赋予alice和bob用户:

1
GRANT SELECT ON all_data TO alice, bob;

打开行访问控制策略开关:

1
ALTER TABLE all_data ENABLE ROW LEVEL SECURITY;

创建行访问控制策略,当前用户只能查看用户自身的数据:

1
CREATE ROW LEVEL SECURITY POLICY all_data_rls ON all_data USING(role = CURRENT_USER);

查看表all_data相关信息:

1
\d+ all_data
图1 查看all_data相关信息

当前用户执行SELECT操作:

1
SELECT * FROM all_data;
图2 SELECT操作
1
EXPLAIN(COSTS OFF) SELECT * FROM all_data;
图3 EXPLAIN操作

切换至alice用户:

1
SET ROLE alice PASSWORD '{Password}';

执行SELECT操作:

1
SELECT * FROM all_data;
图4 执行SELECT操作
1
EXPLAIN(COSTS OFF) SELECT * FROM all_data;
图5 执行EXPLAIN操作
support.huaweicloud.com/sqlreference-dws/dws_06_0169.html