Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] Keep grants for authorized views in sync when using the grant_access_to config #1175

Open
3 tasks done
salimmoulouel opened this issue Apr 5, 2024 · 8 comments · May be fixed by #1189
Open
3 tasks done
Labels
enhancement New feature or request grants Issues related to dbt's grants functionality

Comments

@salimmoulouel
Copy link
Contributor

salimmoulouel commented Apr 5, 2024

Is this your first time submitting a feature request?

  • I have read the expectations for open source contributors
  • I have searched the existing issues, and I could not find an existing issue for this feature
  • I am requesting a straightforward extension of existing dbt functionality, rather than a Big Idea better suited to a discussion

Describe the feature

From #1175 (comment):

My objective is to provide authorized views with access to a specific dataset. In subsequent versions of the view, I aim to modify the dataset to which access is granted. To achieve this, I utilize the "grant_access_to" function rather than "grant." However, in the current implementation, when updating the list of datasets granted access, the previous access permissions are not revoked.
https://docs.getdbt.com/reference/resource-configs/bigquery-configs#authorized-views

Describe alternatives you've considered

No response

Who will this benefit?

No response

Are you interested in contributing this feature?

No response

Anything else?

No response

Original feature description

i want to put a delay waiting in a model, a kind of sleep(60) which make the model wait 60 seconds in that line of code.

@salimmoulouel salimmoulouel added enhancement New feature or request triage labels Apr 5, 2024
@salimmoulouel
Copy link
Contributor Author

currently i've done it with a for i in range(1,1000000) not very convenient

@dbeatty10 dbeatty10 self-assigned this Apr 5, 2024
@dbeatty10
Copy link
Contributor

Thanks for reaching out @salimmoulouel salimmoulouel!

Can you share more about the scenarios in which this would be necessary?

I seem to recall a similar proposal a while back, but I can't find it at the moment. If I recall correctly, we ended up choosing not to pursue it as being out of scope for dbt-core.

@dbeatty10 dbeatty10 removed their assignment Apr 5, 2024
@salimmoulouel
Copy link
Contributor Author

My requirement involves removing outdated grants from a BigQuery authorized view during its recreation. To accomplish this, I utilize a materialization process that iteratively updates a dataset multiple times. To ensure compliance with Google's constraints, particularly the limit on dataset update operations per dataset per 10 seconds, I aim to introduce a delay. This delay helps regulate the frequency of updates and prevents exceeding the specified quota.

I am also open to exploring alternative solutions for removing outdated grants from BigQuery authorized views, especially if they can seamlessly manage multiple projects. Any suggestions in this regard would be greatly appreciated.

@dbeatty10
Copy link
Contributor

Thanks for sharing your particular use-case!

Did you already try configuring grants in dbt, by any chance? I haven't tried this feature with BigQuery authorized views, so I'm not sure how well they work together or not.

@salimmoulouel
Copy link
Contributor Author

i tried it, to grant access it's easy, but to update them it's a whole other thing.

@dbeatty10
Copy link
Contributor

The grants feature is supposed to update the grants by issuing revoke statements when necessary [1] [2].

When you update your grants config in dbt to remove a user and you check your debug logs, are you finding that it isn't issuing a revoke statement?

@salimmoulouel
Copy link
Contributor Author

To clarify my issue further, I apologize for any lack of clarity. My objective is to provide authorized views with access to a specific dataset. In subsequent versions of the view, I aim to modify the dataset to which access is granted. To achieve this, I utilize the "grant_access_to" function rather than "grant." However, in the current implementation, when updating the list of datasets granted access, the previous access permissions are not revoked.
https://docs.getdbt.com/reference/resource-configs/bigquery-configs#authorized-views

@dbeatty10
Copy link
Contributor

Thanks for the clarification @salimmoulouel 👍

We don't plan on adding a sleep() function into dbt-core, but we could definitely consider keeping grants in sync within BigQuery authorized views when using the grant_access_to config (originally added within dbt-labs/dbt-core#2517).

I'm going to update the issue title and transfer this to the dbt-bigquery repo for further consideration.

@dbeatty10 dbeatty10 changed the title [Feature] I need to put a time delay in my model ( kind of sleep in python ) [Feature] Keep grants for authorized views in sync when using the grant_access_to config Apr 9, 2024
@dbeatty10 dbeatty10 transferred this issue from dbt-labs/dbt-core Apr 9, 2024
@dbeatty10 dbeatty10 added the grants Issues related to dbt's grants functionality label Apr 18, 2024
@salimmoulouel salimmoulouel linked a pull request Apr 22, 2024 that will close this issue
4 tasks
@amychen1776 amychen1776 removed the triage label Aug 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request grants Issues related to dbt's grants functionality
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants