You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/unify/data-graph/setup-guides/databricks-setup.md
+7-8Lines changed: 7 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -43,7 +43,7 @@ If you already have a Service Principal user you'd like to use, grant it "Can us
43
43
> Segment recommends creating a new database for the Data Graph.
44
44
> If you choose to use an existing database that has also been used for [Segment Reverse ETL](/docs/connections/reverse-etl/), you must follow the [additional instructions](#update-user-access-for-segment-reverse-etl-catalog) to update user access for the Segment Reverse ETL catalog.
45
45
46
-
```SQL
46
+
```sql
47
47
CREATE CATALOG IF NOT EXISTS `SEGMENT_LINKED_PROFILES_DB`;
48
48
-- Copy the saved Client ID from previously generated secret
49
49
GRANT USAGE ON CATALOG `SEGMENT_LINKED_PROFILES_DB` TO `${client_id}`;
@@ -55,14 +55,14 @@ GRANT SELECT ON CATALOG `SEGMENT_LINKED_PROFILES_DB` TO `${client_id}`;
55
55
56
56
Run the following SQL to grant the Data Graph read-only access to the Profiles Sync catalog:
57
57
58
-
```SQL
58
+
```sql
59
59
GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${profiles_sync_catalog}` TO `${client_id}`;
60
60
```
61
61
62
62
## Step 4: Grant read-only access to additional catalogs for the Data Graph
63
63
Run the following SQL to grant your Service Principal user read-only access to any additional catalogs you want to use for the Data Graph.
64
64
65
-
```SQL
65
+
```sql
66
66
-- ********** REPEAT THIS COMMAND FOR EACH CATALOG YOU WANT TO USE FOR THE DATA GRAPH **********
67
67
GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${catalog}` TO `${client_id}`;
68
68
```
@@ -73,18 +73,17 @@ GRANT USAGE, SELECT, USE SCHEMA ON CATALOG `${catalog}` TO `${client_id}`;
73
73
74
74
Restrict access to specific schemas by running the following SQL:
75
75
76
-
```SQL
76
+
```sql
77
77
GRANT USAGE ON CATALOG `${catalog}` TO `${client_id}`;
78
78
USE CATALOG `${catalog}`;
79
79
GRANT USAGE, SELECTON SCHEMA `${schema_1}` TO `${client_id}`;
80
80
GRANT USAGE, SELECTON SCHEMA `${schema_2}` TO `${client_id}`;
81
81
...
82
-
83
82
```
84
83
### Restrict read-only access to tables
85
84
Restrict access to specific tables by running the following SQL:
86
85
87
-
```SQL
86
+
```sql
88
87
GRANT USAGE ON CATALOG `${catalog}` TO `${client_id}`;
89
88
USE CATALOG `${catalog}`;
90
89
GRANT USAGE ON SCHEMA `${schema_1}` TO `${client_id}`;
@@ -102,7 +101,7 @@ Sign in to the [Databricks CLI with your Client ID secret](https://docs.databric
102
101
> success ""
103
102
> If this command succeeds, you can view the table.
104
103
105
-
```SQL
104
+
```sql
106
105
USE DATABASE ${linked_read_only_database} ;
107
106
SHOW SCHEMAS;
108
107
SELECT*FROM ${schema}.${table} LIMIT10;
@@ -128,6 +127,6 @@ To connect your warehouse to the Data Graph:
128
127
## Update user access for Segment Reverse ETL catalog
129
128
If Segment Reverse ETL has ever run in the catalog you are configuring as the Segment connection catalog, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing catalog. Run the following SQL if you run into an error on the Segment app indicating that the user doesn’t have sufficient privileges on an existing `_segment_reverse_etl` catalog.
130
129
131
-
```SQL
130
+
```sql
132
131
GRANT ALL PRIVILEGES ON SCHEMA ${segment_internal_catalog}.__segment_reverse_etl TO `${client_id}`;
Copy file name to clipboardExpand all lines: src/unify/data-graph/setup-guides/snowflake-setup.md
+5-6Lines changed: 5 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,7 @@ Segment recommends setting up a new Snowflake user and only giving this user per
26
26
> If you choose to use an existing database that has also been used for [Segment Reverse ETL](/docs/connections/reverse-etl/), you must follow the [additional instructions](#update-user-access-for-segment-reverse-etl-schema)to update user access for the Segment Reverse ETL schema.
27
27
28
28
29
-
```SQL
29
+
```sql
30
30
-- ********** SET UP THE FOLLOWING WAREHOUSE PERMISSIONS **********
31
31
32
32
-- Update the following variables
@@ -82,7 +82,7 @@ GRANT CREATE SCHEMA ON DATABASE identifier($segment_connection_db) TO ROLE iden
82
82
83
83
Next, give the Segment role **read-only** access to additional databases you want to use for Data Graph including the Profiles Sync database. Repeat the following SQL query for **each** database you want to use for the Data Graph.
84
84
85
-
```SQL
85
+
```sql
86
86
87
87
SET segment_connection_role ='SEGMENT_LINKED_ROLE';
88
88
@@ -107,7 +107,7 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE identifier($linked_read_on
107
107
108
108
If you want to restrict access to specific [Snowflake schemas and tables](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank"}, then run the following commands:
109
109
110
-
```SQL
110
+
```sql
111
111
-- [Optional] Further restrict access to only specific schemas and tables
112
112
SET db ='MY_DB';
113
113
SET schema ='MY_DB.MY_SCHEMA_NAME';
@@ -131,7 +131,7 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA identifier($linked_read_only
131
131
132
132
To verify you have set up the right permissions for a specific table, log in with the username and password you created for `SEGMENT_CONNECTION_USERNAME` and run the following command to verify the role you created has the correct permissions. If this command succeeds, you should be able to view the respective table.
133
133
134
-
```SQL
134
+
```sql
135
135
set segment_connection_role ='SEGMENT_LINKED_ROLE';
136
136
set linked_read_only_database ='YOUR_DB';
137
137
set table_name ='YOUR_DB.SCHEMA.TABLE';
@@ -163,12 +163,11 @@ To connect your warehouse to the Data Graph:
163
163
## Update user acccess for Segment Reverse ETL schema
164
164
If Segment Reverse ETL has ever run in the database you are configuring as the Segment connection database, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing schema. Run the following SQL if you run into an error on the Segment app indicating that the user doesn't have sufficient privileges on an existing `_segment_reverse_etl` schema.
165
165
166
-
```SQL
166
+
```sql
167
167
-- If you want to use an existing database that already has Segment Reverse ETL schemas, you’ll need to run some additional steps below to grant the role access to the existing schemas.
168
168
169
169
SET retl_schema = concat($segment_connection_db,'.__segment_reverse_etl');
170
170
GRANT USAGE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role);
171
171
GRANT CREATE TABLE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role);
172
172
GRANTSELECT,INSERT,UPDATE,DELETEON ALL TABLES IN SCHEMA identifier($retl_schema) TO ROLE identifier($segment_connection_role);
0 commit comments