Skip to content

Commit

Permalink
Merge pull request #6984 from segmentio/linked-audiences-syntax-highl…
Browse files Browse the repository at this point in the history
…ighting

Update Data Graph SQL Code Blocks
  • Loading branch information
pwseg authored Aug 27, 2024
2 parents e5d5d33 + 5daf69b commit ade9d4a
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 14 deletions.
15 changes: 7 additions & 8 deletions src/unify/data-graph/setup-guides/databricks-setup.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ If you already have a Service Principal user you'd like to use, grant it "Can us
> Segment recommends creating a new database for the Data Graph.
> If you choose to use an existing database that has also been used for [Segment Reverse ETL](/docs/connections/reverse-etl/), you must follow the [additional instructions](#update-user-access-for-segment-reverse-etl-catalog) to update user access for the Segment Reverse ETL catalog.
```SQL
```sql
CREATE CATALOG IF NOT EXISTS `SEGMENT_LINKED_PROFILES_DB`;
-- Copy the saved Client ID from previously generated secret
GRANT USAGE ON CATALOG `SEGMENT_LINKED_PROFILES_DB` TO `${client_id}`;
Expand All @@ -55,14 +55,14 @@ GRANT SELECT ON CATALOG `SEGMENT_LINKED_PROFILES_DB` TO `${client_id}`;

Run the following SQL to grant the Data Graph read-only access to the Profiles Sync catalog:

```SQL
```sql
GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${profiles_sync_catalog}` TO `${client_id}`;
```

## Step 4: Grant read-only access to additional catalogs for the Data Graph
Run the following SQL to grant your Service Principal user read-only access to any additional catalogs you want to use for the Data Graph.

```SQL
```sql
-- ********** REPEAT THIS COMMAND FOR EACH CATALOG YOU WANT TO USE FOR THE DATA GRAPH **********
GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${catalog}` TO `${client_id}`;
```
Expand All @@ -73,18 +73,17 @@ GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${catalog}` TO `${client_id}`;

Restrict access to specific schemas by running the following SQL:

```SQL
```sql
GRANT USAGE ON CATALOG `${catalog}` TO `${client_id}`;
USE CATALOG `${catalog}`;
GRANT USAGE, SELECT ON SCHEMA `${schema_1}` TO `${client_id}`;
GRANT USAGE, SELECT ON SCHEMA `${schema_2}` TO `${client_id}`;
...

```
### Restrict read-only access to tables
Restrict access to specific tables by running the following SQL:

```SQL
```sql
GRANT USAGE ON CATALOG `${catalog}` TO `${client_id}`;
USE CATALOG `${catalog}`;
GRANT USAGE ON SCHEMA `${schema_1}` TO `${client_id}`;
Expand All @@ -102,7 +101,7 @@ Sign in to the [Databricks CLI with your Client ID secret](https://docs.databric
> success ""
> If this command succeeds, you can view the table.
```SQL
```sql
USE DATABASE ${linked_read_only_database} ;
SHOW SCHEMAS;
SELECT * FROM ${schema}.${table} LIMIT 10;
Expand All @@ -128,6 +127,6 @@ To connect your warehouse to the Data Graph:
## Update user access for Segment Reverse ETL catalog
If Segment Reverse ETL has ever run in the catalog you are configuring as the Segment connection catalog, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing catalog. Run the following SQL if you run into an error on the Segment app indicating that the user doesn’t have sufficient privileges on an existing `_segment_reverse_etl` catalog.

```SQL
```sql
GRANT ALL PRIVILEGES ON SCHEMA ${segment_internal_catalog}.__segment_reverse_etl TO `${client_id}`;
```
11 changes: 5 additions & 6 deletions src/unify/data-graph/setup-guides/snowflake-setup.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ Segment recommends setting up a new Snowflake user and only giving this user per
> If you choose to use an existing database that has also been used for [Segment Reverse ETL](/docs/connections/reverse-etl/), you must follow the [additional instructions](#update-user-access-for-segment-reverse-etl-schema)to update user access for the Segment Reverse ETL schema.

```SQL
```sql
-- ********** SET UP THE FOLLOWING WAREHOUSE PERMISSIONS **********

-- Update the following variables
Expand Down Expand Up @@ -82,7 +82,7 @@ GRANT CREATE SCHEMA ON DATABASE identifier($segment_connection_db) TO ROLE iden

Next, give the Segment role **read-only** access to additional databases you want to use for Data Graph including the Profiles Sync database. Repeat the following SQL query for **each** database you want to use for the Data Graph.

``` SQL
```sql

SET segment_connection_role = 'SEGMENT_LINKED_ROLE';

Expand All @@ -107,7 +107,7 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE identifier($linked_read_on

If you want to restrict access to specific [Snowflake schemas and tables](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank"}, then run the following commands:

```SQL
```sql
-- [Optional] Further restrict access to only specific schemas and tables
SET db = 'MY_DB';
SET schema = 'MY_DB.MY_SCHEMA_NAME';
Expand All @@ -131,7 +131,7 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA identifier($linked_read_only

To verify you have set up the right permissions for a specific table, log in with the username and password you created for `SEGMENT_CONNECTION_USERNAME` and run the following command to verify the role you created has the correct permissions. If this command succeeds, you should be able to view the respective table.

``` SQL
```sql
set segment_connection_role = 'SEGMENT_LINKED_ROLE';
set linked_read_only_database = 'YOUR_DB';
set table_name = 'YOUR_DB.SCHEMA.TABLE';
Expand Down Expand Up @@ -163,12 +163,11 @@ To connect your warehouse to the Data Graph:
## Update user acccess for Segment Reverse ETL schema
If Segment Reverse ETL has ever run in the database you are configuring as the Segment connection database, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing schema. Run the following SQL if you run into an error on the Segment app indicating that the user doesn't have sufficient privileges on an existing `_segment_reverse_etl` schema.

``` SQL
```sql
-- If you want to use an existing database that already has Segment Reverse ETL schemas, you’ll need to run some additional steps below to grant the role access to the existing schemas.

SET retl_schema = concat($segment_connection_db,'.__segment_reverse_etl');
GRANT USAGE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role);
GRANT CREATE TABLE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role);
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role);

```

0 comments on commit ade9d4a

Please sign in to comment.