Skip to content

Commit bc18b1c

Browse files
corydonbaylorcorydonbaylor
committed
last ones
1 parent 05815ed commit bc18b1c

File tree

2 files changed

+70
-82
lines changed

2 files changed

+70
-82
lines changed

‎modules/snowflake-analytics/pages/neo4j-marketing-segmentation.adoc‎

Lines changed: 34 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -265,43 +265,42 @@ Next we grant the necessary permissions:
265265

266266
[source,sql]
267267
----
268+
-- Use a role with the required privileges
268269
USE ROLE ACCOUNTADMIN;
269-
----
270270
271-
[source,sql]
272-
----
273-
-- Create a consumer role for users and admins of the GDS application
274-
CREATE ROLE IF NOT EXISTS gds_user_role;
275-
CREATE ROLE IF NOT EXISTS gds_admin_role;
276-
GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role;
277-
GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_admin_role;
278-
279-
CREATE DATABASE ROLE IF NOT EXISTS gds_db_role;
280-
GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role;
281-
GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics;
282-
283-
-- Grant access to consumer data
284-
GRANT USAGE ON DATABASE RETAIL_RECS TO ROLE gds_user_role;
285-
GRANT USAGE ON SCHEMA RETAIL_RECS.PUBLIC TO ROLE gds_user_role;
286-
287-
-- Required to read tabular data into a graph
288-
GRANT SELECT ON ALL TABLES IN DATABASE RETAIL_RECS TO DATABASE ROLE gds_db_role;
289-
290-
-- Ensure the consumer role has access to created tables/views
291-
GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role;
292-
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role;
293-
GRANT CREATE TABLE ON SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role;
294-
GRANT CREATE VIEW ON SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role;
295-
GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role;
296-
GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role;
297-
298-
-- Compute and warehouse access
299-
GRANT USAGE ON WAREHOUSE NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE TO APPLICATION neo4j_graph_analytics;
300-
----
301-
302-
[source,sql]
303-
----
304-
use role gds_role;
271+
-- Create a consumer role for users of the Graph Analytics application
272+
CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE;
273+
GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE;
274+
SET MY_USER = (SELECT CURRENT_USER());
275+
GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER);
276+
277+
USE SCHEMA retail_recs.PUBLIC;
278+
CREATE TABLE NODES (nodeId Number);
279+
INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6);
280+
CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number);
281+
INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6);
282+
283+
-- Grants needed for the app to read consumer data stored in tables and views, using a database role
284+
USE DATABASE retail_recs;
285+
CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE;
286+
GRANT USAGE ON DATABASE retail_recs TO DATABASE ROLE MY_DB_ROLE;
287+
GRANT USAGE ON SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
288+
GRANT SELECT ON ALL TABLES IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
289+
GRANT SELECT ON ALL VIEWS IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
290+
-- Future tables also include tables that are created by the application itself.
291+
-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input.
292+
GRANT SELECT ON FUTURE TABLES IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
293+
GRANT SELECT ON FUTURE VIEWS IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
294+
GRANT CREATE TABLE ON SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
295+
GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics;
296+
297+
-- Ensure the consumer role has access to tables created by the application
298+
GRANT USAGE ON DATABASE retail_recs TO ROLE MY_CONSUMER_ROLE;
299+
GRANT USAGE ON SCHEMA retail_recs.PUBLIC TO ROLE MY_CONSUMER_ROLE;
300+
GRANT SELECT ON FUTURE TABLES IN SCHEMA retail_recs.PUBLIC TO ROLE MY_CONSUMER_ROLE;
301+
302+
-- Use the consumer role to run the algorithm and inspect the output
303+
USE ROLE MY_CONSUMER_ROLE;
305304
----
306305

307306
== Running our Algorithms

‎modules/snowflake-analytics/pages/neo4j-subways.adoc‎

Lines changed: 36 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -78,53 +78,42 @@ you are using `accountadmin` to grant and create roles. Lets do that
7878
now:
7979

8080
....
81-
USE ROLE accountadmin;
82-
....
83-
84-
Next let’s set up the necessary roles, permissions, and resource access
85-
to enable Graph Analytics to operate on data within the
86-
`mta.public schema`. It creates a consumer role (gds++_++user++_++role)
87-
for users and administrators, grants the Neo4j Graph Analytics
88-
application access to read from and write to tables and views, and
89-
ensures that future tables are accessible.
90-
91-
It also provides the application with access to the required compute
92-
pool and warehouse resources needed to run graph algorithms at scale.
93-
94-
....
95-
-- Create a consumer role for users and admins of the GDS application
96-
CREATE ROLE IF NOT EXISTS gds_user_role;
97-
CREATE ROLE IF NOT EXISTS gds_admin_role;
98-
GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role;
99-
GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_admin_role;
100-
101-
CREATE DATABASE ROLE IF NOT EXISTS gds_db_role;
102-
GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role;
103-
GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics;
104-
105-
-- Grant access to consumer data
106-
GRANT USAGE ON DATABASE MTA TO ROLE gds_user_role;
107-
GRANT USAGE ON SCHEMA MTA.PUBLIC TO ROLE gds_user_role;
108-
109-
-- Required to read tabular data into a graph
110-
GRANT SELECT ON ALL TABLES IN DATABASE MTA TO DATABASE ROLE gds_db_role;
111-
112-
-- Ensure the consumer role has access to created tables/views
113-
GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role;
114-
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role;
115-
GRANT CREATE TABLE ON SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role;
116-
GRANT CREATE VIEW ON SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role;
117-
GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role;
118-
GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role;
119-
120-
-- Compute and warehouse access
121-
GRANT USAGE ON WAREHOUSE NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE TO APPLICATION neo4j_graph_analytics;
122-
....
123-
124-
Then we need to switch the role we created:
125-
126-
....
127-
USE ROLE gds_user_role;
81+
-- Use a role with the required privileges
82+
USE ROLE ACCOUNTADMIN;
83+
84+
-- Create a consumer role for users of the Graph Analytics application
85+
CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE;
86+
GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE;
87+
SET MY_USER = (SELECT CURRENT_USER());
88+
GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER);
89+
90+
USE SCHEMA MTA.PUBLIC;
91+
CREATE TABLE NODES (nodeId Number);
92+
INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6);
93+
CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number);
94+
INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6);
95+
96+
-- Grants needed for the app to read consumer data stored in tables and views, using a database role
97+
USE DATABASE MTA;
98+
CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE;
99+
GRANT USAGE ON DATABASE MTA TO DATABASE ROLE MY_DB_ROLE;
100+
GRANT USAGE ON SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
101+
GRANT SELECT ON ALL TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
102+
GRANT SELECT ON ALL VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
103+
-- Future tables also include tables that are created by the application itself.
104+
-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input.
105+
GRANT SELECT ON FUTURE TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
106+
GRANT SELECT ON FUTURE VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
107+
GRANT CREATE TABLE ON SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE;
108+
GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics;
109+
110+
-- Ensure the consumer role has access to tables created by the application
111+
GRANT USAGE ON DATABASE MTA TO ROLE MY_CONSUMER_ROLE;
112+
GRANT USAGE ON SCHEMA MTA.PUBLIC TO ROLE MY_CONSUMER_ROLE;
113+
GRANT SELECT ON FUTURE TABLES IN SCHEMA MTA.PUBLIC TO ROLE MY_CONSUMER_ROLE;
114+
115+
-- Use the consumer role to run the algorithm and inspect the output
116+
USE ROLE MY_CONSUMER_ROLE;
128117
....
129118

130119
=== Cleaning Our Data

0 commit comments

Comments
 (0)