diff --git a/src/unify/data-graph/setup-guides/databricks-setup.md b/src/unify/data-graph/setup-guides/databricks-setup.md index 9a899774da..3445abfd35 100644 --- a/src/unify/data-graph/setup-guides/databricks-setup.md +++ b/src/unify/data-graph/setup-guides/databricks-setup.md @@ -43,7 +43,7 @@ If you already have a Service Principal user you'd like to use, grant it "Can us > Segment recommends creating a new database for the Data Graph. > If you choose to use an existing database that has also been used for [Segment Reverse ETL](/docs/connections/reverse-etl/), you must follow the [additional instructions](#update-user-access-for-segment-reverse-etl-catalog) to update user access for the Segment Reverse ETL catalog. -```SQL +```sql CREATE CATALOG IF NOT EXISTS `SEGMENT_LINKED_PROFILES_DB`; -- Copy the saved Client ID from previously generated secret GRANT USAGE ON CATALOG `SEGMENT_LINKED_PROFILES_DB` TO `${client_id}`; @@ -55,14 +55,14 @@ GRANT SELECT ON CATALOG `SEGMENT_LINKED_PROFILES_DB` TO `${client_id}`; Run the following SQL to grant the Data Graph read-only access to the Profiles Sync catalog: -```SQL +```sql GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${profiles_sync_catalog}` TO `${client_id}`; ``` ## Step 4: Grant read-only access to additional catalogs for the Data Graph Run the following SQL to grant your Service Principal user read-only access to any additional catalogs you want to use for the Data Graph. -```SQL +```sql -- ********** REPEAT THIS COMMAND FOR EACH CATALOG YOU WANT TO USE FOR THE DATA GRAPH ********** GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${catalog}` TO `${client_id}`; ``` @@ -73,18 +73,17 @@ GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${catalog}` TO `${client_id}`; Restrict access to specific schemas by running the following SQL: -```SQL +```sql GRANT USAGE ON CATALOG `${catalog}` TO `${client_id}`; USE CATALOG `${catalog}`; GRANT USAGE, SELECT ON SCHEMA `${schema_1}` TO `${client_id}`; GRANT USAGE, SELECT ON SCHEMA `${schema_2}` TO `${client_id}`; ... - ``` ### Restrict read-only access to tables Restrict access to specific tables by running the following SQL: -```SQL +```sql GRANT USAGE ON CATALOG `${catalog}` TO `${client_id}`; USE CATALOG `${catalog}`; GRANT USAGE ON SCHEMA `${schema_1}` TO `${client_id}`; @@ -102,7 +101,7 @@ Sign in to the [Databricks CLI with your Client ID secret](https://docs.databric > success "" > If this command succeeds, you can view the table. -```SQL +```sql USE DATABASE ${linked_read_only_database} ; SHOW SCHEMAS; SELECT * FROM ${schema}.${table} LIMIT 10; @@ -128,6 +127,6 @@ To connect your warehouse to the Data Graph: ## Update user access for Segment Reverse ETL catalog If Segment Reverse ETL has ever run in the catalog you are configuring as the Segment connection catalog, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing catalog. Run the following SQL if you run into an error on the Segment app indicating that the user doesn’t have sufficient privileges on an existing `_segment_reverse_etl` catalog. -```SQL +```sql GRANT ALL PRIVILEGES ON SCHEMA ${segment_internal_catalog}.__segment_reverse_etl TO `${client_id}`; ``` diff --git a/src/unify/data-graph/setup-guides/snowflake-setup.md b/src/unify/data-graph/setup-guides/snowflake-setup.md index e458744f88..faadc78e8a 100644 --- a/src/unify/data-graph/setup-guides/snowflake-setup.md +++ b/src/unify/data-graph/setup-guides/snowflake-setup.md @@ -26,7 +26,7 @@ Segment recommends setting up a new Snowflake user and only giving this user per > If you choose to use an existing database that has also been used for [Segment Reverse ETL](/docs/connections/reverse-etl/), you must follow the [additional instructions](#update-user-access-for-segment-reverse-etl-schema)to update user access for the Segment Reverse ETL schema. -```SQL +```sql -- ********** SET UP THE FOLLOWING WAREHOUSE PERMISSIONS ********** -- Update the following variables @@ -82,7 +82,7 @@ GRANT CREATE SCHEMA ON DATABASE identifier($segment_connection_db) TO ROLE iden Next, give the Segment role **read-only** access to additional databases you want to use for Data Graph including the Profiles Sync database. Repeat the following SQL query for **each** database you want to use for the Data Graph. -``` SQL +```sql SET segment_connection_role = 'SEGMENT_LINKED_ROLE'; @@ -107,7 +107,7 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE identifier($linked_read_on If you want to restrict access to specific [Snowflake schemas and tables](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank"}, then run the following commands: -```SQL +```sql -- [Optional] Further restrict access to only specific schemas and tables SET db = 'MY_DB'; SET schema = 'MY_DB.MY_SCHEMA_NAME'; @@ -131,7 +131,7 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA identifier($linked_read_only To verify you have set up the right permissions for a specific table, log in with the username and password you created for `SEGMENT_CONNECTION_USERNAME` and run the following command to verify the role you created has the correct permissions. If this command succeeds, you should be able to view the respective table. -``` SQL +```sql set segment_connection_role = 'SEGMENT_LINKED_ROLE'; set linked_read_only_database = 'YOUR_DB'; set table_name = 'YOUR_DB.SCHEMA.TABLE'; @@ -163,12 +163,11 @@ To connect your warehouse to the Data Graph: ## Update user acccess for Segment Reverse ETL schema If Segment Reverse ETL has ever run in the database you are configuring as the Segment connection database, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing schema. Run the following SQL if you run into an error on the Segment app indicating that the user doesn't have sufficient privileges on an existing `_segment_reverse_etl` schema. -``` SQL +```sql -- If you want to use an existing database that already has Segment Reverse ETL schemas, you’ll need to run some additional steps below to grant the role access to the existing schemas. SET retl_schema = concat($segment_connection_db,'.__segment_reverse_etl'); GRANT USAGE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role); GRANT CREATE TABLE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role); GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role); - ``` \ No newline at end of file