dbt-labs / dbt-bigquery

dbt-bigquery contains all of the code required to make dbt operate on a BigQuery database.
https://github.com/dbt-labs/dbt-bigquery
Apache License 2.0
219 stars 154 forks source link

[Bug] `grants` not working for `dbt clone` in dbt-bigquery #1317

Open SPTKL opened 6 months ago

SPTKL commented 6 months ago

Is this a new bug in dbt-bigquery?

Current Behavior

Currently I'm running write-audit-publish, I build my models with proper grants in a staging environment then clone over to prod. When cloning to prod, the cloned tables are missing grants compared to the staging tables.

Expected Behavior

When cloning, we should also replicate dbt granted permissions

Steps To Reproduce

Suppose I have a model test_model.sql

{{ 
    config(
        materialized = 'table', 
        grants = {'roles/bigquery.dataViewer': ['user:someone@yourcompany.com']}
    ) 
}}

SELECT 1 AS column

then execute dbt run -s test_model --target-path staging --target staging to create a staging table. Once the staging table is created, we can then proceed to clone it to prod. Dbt grants should work properly on staging table. Double check if the data viewer permission is granted. If so, we then execute dbt clone -s test_model --state staging --target-path prod --target prod. After cloning completes, we can check the permissions to the prod table, and you will not find the data viewer permission granted to user:someone@yourcompany.com

Relevant log output

No response

Environment

- OS: Mac 13.6
- Python: 3.8.12
- dbt-core: 1.6.13
- dbt-bigquery: 1.6.7

Additional Context

according to dbt-core, it does seem like we have code for grants in the clone materialization. However, not sure why it's not working for BQ https://github.com/dbt-labs/dbt-core/blob/b4f57aad5dd107246577ae544c1f71c7d27ba804/core/dbt/include/global_project/macros/materializations/models/clone/clone.sql#L39-L42

dbeatty10 commented 3 months ago

The following applies the grants on the cloned object when using dbt-postgres:

Files:

models/test_model.sql

{{ 
    config(
        materialized="table",
        grants={'select': ["dbt_test_user_1", "dbt_test_user_2"]}
    ) 
}}

select 1 as my_column

Commands:

dbt run   -s test_model --target-path staging --target staging
dbt clone -s test_model --target-path prod    --target prod    --state staging

It also works if I do the configuration in a YAML file instead:

models/_models.yml

models:
  - name: test_model
    config:
      grants:
        select: ["dbt_test_user_1", "dbt_test_user_2"]