Package: redshift-user-manager
redshift-user-managerRedshift User Manager (RUM) is a user manager for AWS Redshift.
It can create/delete users and grant/revoke permissions from those users.
RUM works with a roles and permissions model which are defined in a config YAML file.
Permissions define the actual access to schemas/tables.
Permissions are then assigned to roles, and roles can be granted to users.InstallationRUM is installed via pip and requires python >= 3.6pip install redshift-user-managerOnce installed it can be invoked on the command line with therumcommand.rum versionConfig YAMLRUM must be given a config yaml file which defines: the database that it is operating on, the permissions definitions, and role definitions.host:a-database.abcd1234.us-east-1.redshift.amazonaws.comport:5439database:a-databaseroles:read-all:permissions:-r-allread-write-all:permissions:-rw-allpermissions:r-all:level:READentities:"*"rw-all:level:READentities:"*"PermissionsA permission can give access to all tables and schemas, all tables within schema(s), or to specific schema/tables.permissions:r-all:level:READentities:"*"rw-all:level:READWRITEentities:"*"rw-schema-a:level:READWRITEentities:-schema-a.*r-table-a:level:READentities:-schema-a.table-arw-table-a-table-b:level:READWRITEentities:-schema-a.table-a-schema-a.table-bLevelEach permission is given a level: (READorREADWRITE). This level determines the level of access given to the given entities.READgivesSELECTaccess to the given entities.READWRITEgivesALLaccess to the given entities.EntitiesEach permission must be given value(s) for the entities field. The possible values are*or a list ofschema.*orschema.table.*will give the given permission level to all tables within all schemas. As well as give default permissions to new entities created by the user which granted these permissions. This is equivalent to explicitly definingschema.*for all schemas in the database, and internally executes the same queries asschema.*.schema.*will give the given permission level to all tables within a specific schemas. As well as give default permissions to new entities created by the user which granted these permissions within that schema.GRANT{SELECT|ALL}ONSCHEMA{schema}TO{user_name};GRANT{USAGE|ALL}ONALLTABLESINSCHEMA{schema}TO{user_name};ALTERDEFAULTPRIVILEGESINSCHEMA{schema}GRANT{SELECT|ALL}ONTABLESTO{user_name};schema.tablewill give the given permission level to a specific table within a specific schema.GRANTUSAGEONSCHEMA{schema}TO{user_name};GRANT{SELECT|ALL}ON{schema}.{table}TO{user_name};RolesRoles are lists of permissions that can then be granted or revoked from specific users. Roles are defined in the config YAML.roles:developer:permissions:-r-all-rw-schema-aread-only:permissions:-r-allThis example config defines two roles:developerandread-only.UsageRUM is invoked via the command line with the commandrum. In order to function RUM must be given 4 pieces of information either by environment variable or passed in as a CLI argument:REDSHIFT_USER_MANAGER_USERNAME: The username used to connect to the database. This user must be a superuser and is the user that is used to create/grant permissions in the database.REDSHIFT_USER_MANAGER_PASSWORD: The password used to connect to the database.REDSHIFT_USER_MANAGER_CONFIG_FILE: A path to theconfig.yamlfile. Defaults to a file namedredshift-user-manager-config.yamlin the current working directory.REDSHIFT_USER_MANAGER_STATE_FILE: A path to thestate.yamlfile which holds the state for RUM. Defaults to a file namedstate.yamlin the current working directory.I recommend putting both the state.yaml and config.yaml into source control so that any changes can be change-tracked.Create a user.You can choose to have RUM generate a random password, or you can give it a password to use for the user. When creating a role, you can optionally pass in roles that you want to grant this user. Roles can be granted or revoked in the future as well.For example, to create a usertest-userwith the password1234, and grant it theread-allrole:rumcreatetest-user-p1234-rread-allDelete a user.When deleting users from redshift, all permissions must first be revoked. RUM handles this for you.For example, to delete the usertest-user:rumdeletetest-userGrant/Revoke roles for/from a user.Roles can be granted and revoked from a user.For example, we will first grant the roler-allto the usertest-user, and then revoke it.rumgranttest-user-rr-all
rumrevoketest-user-rr-allRefresh a user or all users permissions.When new schemas or tables are added or permissions within the config.yaml change, it can be useful to re-apply all permissions to a single, or all users:rumrefreshtest-user
rumrefresh-all