REVOKE FROM ROLE

Access to Dremio objects can be managed by revoking privileges from roles. A privilege is the right to perform a specific action on an object.

Syntax

REVOKE { objectPrivilege | ALL } ON { <object_type> <object_name> }
FROM ROLE <role_name>

Syntax for revoking privileges on all folders in an Open Catalog

REVOKE { objectPrivilege } ON ALL FOLDERS IN CATALOG { <object_name> }
FROM ROLE <role_name>

Syntax for revoking privileges on all tables and views in an Open Catalog

REVOKE { objectPrivilege } ON ALL DATASETS IN CATALOG { <object_name> }
FROM ROLE <role_name>

note

The DELETE, INSERT, TRUNCATE, and UPDATE privileges are supported only for Iceberg tables.

The CREATE TABLE and DROP privileges are supported only for sources that support mutability.

objectPrivilege

-- On Organizations
{ CONFIGURE SECURITY | CONFIGURE BILLING | CREATE CATALOG | CREATE CLOUD | CREATE PROJECT | CREATE ROLE | CREATE USER | MANAGE GRANTS } [, ...]
-- On Clouds
{ MANAGE GRANTS | MODIFY | MONITOR } [, ...]
-- On Projects
{ ALTER | ALTER REFLECTION | CREATE SOURCE | CREATE TABLE | DELETE | DROP | EXTERNAL QUERY | INSERT | MANAGE GRANTS | MODIFY | MONITOR | OPERATE | SELECT | UPDATE | USAGE | VIEW JOB HISTORY | VIEW REFLECTION } [, ...]
-- On Engines
{ MANAGE GRANTS | MODIFY | MONITOR | OPERATE | USAGE } [, ...]
-- On Identity and Token Providers
{ MODIFY | MONITOR | OPERATE } [, ...]
-- On catalog sources
{ ALTER | ALTER REFLECTION | CREATE TABLE | DELETE | DROP | EXTERNAL QUERY | INSERT | MANAGE GRANTS | MODIFY | SELECT | TRUNCATE | UPDATE | VIEW REFLECTION } [, ...]
-- On Folders
{ ALTER | ALTER REFLECTION | CREATE TABLE | DELETE | DROP | INSERT | MANAGE GRANTS | OWNERSHIP | SELECT | SHOW | TRUNCATE | UPDATE | VIEW REFLECTION } [, ...]
-- On Tables in catalog sources
{ ALTER | DELETE | INSERT | MANAGE GRANTS | OWNERSHIP | SELECT | TRUNCATE | UPDATE } [, ...]
-- On Views in catalog sources
{ ALTER | DELETE | INSERT | MANAGE GRANTS | OWNERSHIP | SELECT | TRUNCATE | UPDATE } [, ...]
-- On Scripts
{ VIEW | MODIFY | DELETE | MANAGE GRANTS }
-- On Open Catalogs and sources
{ MANAGE GRANTS | OWNERSHIP | USAGE | MODIFY }
-- On Tables in Open Catalogs
{ ALTER REFLECTION | MANAGE GRANTS | SELECT | VIEW REFLECTION | WRITE }
-- On Views in Open Catalogs
{ ALTER REFLECTION | MANAGE GRANTS | SELECT | VIEW REFLECTION | WRITE }

Parameters

<objectPrivilege> String

The privilege(s) to be revoked from the role. A comma-separated list of privileges can be specified. For more information, read Privileges.

---

<object_type> String

The name of the type of object for which the specified privilege is being revoked.

---

<object_name> String

The name of the object for which the privilege is being revoked. Object names need to be qualified with the path if they are nested.

note

For <object_type> ORG or PROJECT, the <object_name> is inferred and should be omitted from the statement.

---

<role_name> String

The name of the role from which the privilege is being revoked.

Examples

Revoke MODIFY and MONITOR privileges on a cloud from a role

REVOKE MODIFY, MONITOR
ON CLOUD "Default Cloud"
FROM ROLE "DATA_ENGINEER"

Revoke CREATE CLOUD privilege on an organization from a role

REVOKE CREATE CLOUD  
ON ORG
FROM ROLE "DATA_ENGINEER"

Revoke VIEW JOB HISTORY privilege from a role

REVOKE VIEW JOB HISTORY ON SYSTEM FROM ROLE "DATA ANALYST"

Revoke OWNERSHIP privilege on an Open Catalog or source from a role

REVOKE OWNERSHIP ON CATALOG prodCatalog FROM ROLE data_engineer

Revoke SHOW privilege on all folders in an Open Catalog from all users

REVOKE SHOW ON ALL FOLDERS IN CATALOG prodCatalog FROM ROLE "PUBLIC"

Revoke SELECT privilege on all tables and views in an Open Catalog

REVOKE SELECT ON ALL DATASETS IN CATALOG Cat1
FROM ROLE data_engineer