Snowflake Inc.

Bowen Zhang

Benoit Dageville

Shreyas Narendra Desai

Pui Kei Johnston Chu

Prasanna V Krishnan

Subramanian Muralidhar

Damien Carru

Vishnu Dutt Paladugu

German Alberto Gil Echeverri

Chao Ren

Elkhan Mammedov

Rongpeng Zheng

Embodiments of the present disclosure relate to sharing data using database roles. Database roles are generated within a database container of a provider account. Grants to a particular subset of the plurality of data objects of the database container may be assigned to each of the database roles, and each of the database roles are granted to a share object. The share object is mounted within a consumer account to generate an imported copy of each of the database roles. The imported copy of one or more of the database roles is granted to each of one or more account level roles of the consumer account. When a new object is added to a particular database role, it is immediately available for consumption by any account level roles to which the imported copy of the particular database role has been granted.

Fine-grained access control via database roles

Provided herein are systems and methods for providing a secure and efficient way to manage a data exchange's availability and manage the visibility of data listings of the data exchange. For example, the method may comprise specifying, by an exchange admin of the data exchange, a set of regions where the data exchange is available, each of the set of regions comprising one or more remote deployments. The method may further comprise specifying by a data provider, one or more of the set of regions where a data listing owned by the data provider is visible. Upon receiving a request to access the data listing from a remote deployment of the one or more regions, the data provider may determine whether to reject or fulfill the request. In response to determining that the request should be fulfilled, replicating data of the data listing to the remote deployment.

Data exchange availability, listing visibility, and listing fulfillment

Provided herein are systems and methods for replicating share objects to remote deployments. An example method includes generating, at a second deployment in a data exchange, a replica of a share object included in a first deployment of the data exchange. The share object grants privileges to a first account to access a first database of the first deployment, wherein the first database comprises a database object. The method also includes retrieving, at the first deployment, share grant metadata from the share object of the first deployment, wherein the share grant metadata includes a reference to the database object and allows the first account to use the database object. The method also includes transmitting a message comprising the share grant metadata to the replica in the second deployment. The share grant metadata in the replica allows a second account to use the database object replicated in the second deployment.

Share replication between remote deployments

Embodiments of the present disclosure relate to sharing database roles using hidden roles. A database role may be generated within a database container having a plurality of data objects, wherein the database role exists exclusively within the database container. A set of grants to a particular subset of the plurality of data objects of the database container may be assigned to the database role and the database role may be granted to the share object. The share object is mounted within a consumer account to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role. The imported copy of the database role may be granted to each of one or more account level roles of the consumer account to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

Provided herein are systems and methods for an efficient method of replicating share objects to remote deployments. An example method includes receiving, at a first deployment in a data exchange, a refresh message from a second deployment in the data exchange, wherein the first deployment comprises a database that stores a database object. The method also includes, in response to receiving the refresh message, retrieving, at the first deployment, a share grant from a share object of the first deployment and transmitting, by a processing device of the first deployment, a message including the share grant to the second deployment. The share grant includes a reference to the database object and allows a consumer to use the database object.

Embodiments of the present disclosure relate to sharing database roles using hidden roles. A database role may be generated within a database container having a plurality of data objects, wherein the database role exists exclusively within the database container. A set of grants to a particular subset of the plurality of data objects of the database container may be assigned to the database role. For each of a set of share objects to which the database role is to be granted: a hidden role having no identifier may be created, the database role may be granted to the hidden role, and the hidden role may be granted to a share object. Each of the set of share objects are mounted within a consumer account to generate a set of imported database containers within the consumer account, wherein each imported database container includes an individualized grant of the database roles.

Embodiments of the present disclosure provide techniques for defining database roles to allow sharing of the objects within a database in a more granular fashion. A set of database roles is created within a database container of a provider account, each database role comprising a separate object from any of a plurality of objects within the database container. A set of grants to a particular subset of the plurality of data objects of the database container is assigned to each of the set of database roles. A share object to which each of the set of database roles has been granted is mounted within a consumer account, thereby generating an imported database container having an imported copy of each of the set of database roles within the consumer account. Certain imported copies of the set of database roles are granted to account level roles of the consumer account.

Provided herein are systems and methods for an efficient method of replicating share objects to remote deployments. For example, the method may include generating a global representation of a share object of a first database account located in a first region. The share object includes grant metadata associated with a set of objects of a database located in the first region and associated with the first database account. The method may further include, in response to a database refresh command received from a second database account associated with a database replica located in a second region, replicating the set of objects of the database to the database replica. The method may further include, in response to a share refresh command received from the second database account, replicating the grant metadata to a share object replica located in the second region.

Embodiments of the present disclosure provide systems and methods for defining database roles to allow sharing of the objects within a database in a more granular fashion. A database role is created within a database, and privileges are granted to the database role by a provider account. The database role may be granted to a share object, which would result in the share object being indirectly granted all privileges that have been granted to the database role. Once the share object has been hydrated in the consumer account, the local administrator can then decide which local roles are granted usage on the shared database role, thus ultimately allowing some level of filtering as to which shared objects can be accessed by which local roles.

Provided herein are systems and methods for an efficient method of replicating share objects to remote deployments. For example, the method may comprise modifying a share object of a first account of a data exchange into a global object wherein the share object includes grant metadata indicating share grants to a set of objects of a database. The method may further comprise creating, in a second account of the data exchange, a local replica of the share object on the remote deployment based on the global object, wherein the second account is located in a remote deployment. The set of objects of the database may be replicated to a local database replica on the remote deployment and the share grants may be replicated to the local replica of the share object.

Growing community of inventors

Newark, CA, United States of America

Bowen Zhang