Skip to content

Benefits: Add row-level security to benefits mart table #4943

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
charlie-costanzo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Benefits: Add row-level security to benefits mart table #4943

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 60 additions & 0 deletions warehouse/macros/create_row_access_policy.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,3 +230,63 @@ filter using (
) }};
-- TODO: In the last policy of the macro call above, see if we can get the prod warehouse service account out of context
{% endmacro %}


{% macro benefits_row_access_policy() %}

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'Monterey-Salinas Transit',
principals = ['serviceAccount:mst-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'Sacramento Regional Transit',
principals = ['serviceAccount:sacrt-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'Santa Barbara MTD',
principals = ['serviceAccount:sbmtd-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'Nevada County Connects',
principals = ['serviceAccount:nevada-county-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'Ventura County Transportation Commission',
principals = ['serviceAccount:vctc-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'El Dorado Transit',
principals = ['serviceAccount:eldorado-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
filter_column = 'event_properties_transit_agency',
filter_value = 'San Luis Obispo RTA',
principals = ['serviceAccount:slorta-payments-user@cal-itp-data-infra.iam.gserviceaccount.com']
) }};

{{ create_row_access_policy(
principals = [
'serviceAccount:metabase@cal-itp-data-infra.iam.gserviceaccount.com',
'serviceAccount:metabase-payments-team@cal-itp-data-infra.iam.gserviceaccount.com',
'serviceAccount:github-actions-services-accoun@cal-itp-data-infra.iam.gserviceaccount.com',
'serviceAccount:github-actions-service-account@cal-itp-data-infra.iam.gserviceaccount.com',
'serviceAccount:github-actions-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com',
'serviceAccount:composer-service-account@cal-itp-data-infra.iam.gserviceaccount.com',
'principalSet://iam.googleapis.com/locations/global/workforcePools/dot-ca-gov/group/DDS_Cloud_Admins',
'principalSet://iam.googleapis.com/locations/global/workforcePools/dot-ca-gov/group/DOT_DDS_Data_Pipeline_and_Warehouse_Users'
]
) }};
-- TODO: In the last policy of the macro call above, see if we can get the prod warehouse service account out of context
{% endmacro %}
3 changes: 2 additions & 1 deletion warehouse/models/mart/benefits/fct_benefits_events.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
{{ config(materialized='table') }}
{{ config(materialized = 'table',
post_hook="{{ benefits_row_access_policy() }}") }}

WITH fct_benefits_events_raw AS (
-- fct_benefits_events_raw extracts JSON columns and
Expand Down
Loading