REVOKE FROM ROLE

Access to Dremio objects can be managed by revoking privileges from roles. A privilege is the right to perform a specific action on an object.

Syntax

REVOKE { objectPrivilege | ALL } ON { <object_type> <object_name> }
FROM ROLE <role_name>

objectPrivilege

-- On Organizations
{ CONFIGURE SECURITY | CREATE CATALOG | CREATE CLOUD | CREATE PROJECT | MANAGE GRANTS } [, ...]
-- On Clouds
{ MANAGE GRANTS | MODIFY | MONITOR } [, ...]
-- On Projects
{ ALTER | ALTER REFLECTION | CREATE TABLE | DROP | EXTERNAL QUERY | MANAGE GRANTS | MODIFY | MONITOR | OPERATE | SELECT | VIEW REFLECTION | USAGE | VIEW JOB HISTORY } [, ...]
-- On Engines
{ MODIFY | MONITOR | OPERATE | USAGE } [, ...]
-- On Identity and Token Providers
{ MODIFY | MONITOR | OPERATE | USAGE } [, ...]
-- On Sources
{ ALTER | ALTER REFLECTION | CREATE TABLE | DROP | EXTERNAL QUERY | MANAGE GRANTS | MODIFY | SELECT } [, ...]
-- On Spaces
{ ALTER | ALTER REFLECTION | MANAGE GRANTS | MODIFY | SELECT } [, ...]
-- On Folders
{ ALTER | ALTER REFLECTION | CREATE TABLE | DROP | MANAGE GRANTS | SELECT } [, ...]
-- On Tables
{ ALTER | MANAGE GRANTS } [, ...]
-- On Views
{ ALTER | MANAGE GRANTS } [, ...]

Parameters

{{< sql-section file="data/sql/privileges.json" data="revokingPrivilegesParametersRole" >}}

Examples

Revoke MODIFY and MONITOR privileges on a cloud from a role

REVOKE MODIFY, MONITOR
ON CLOUD "Default Cloud"
FROM ROLE "DATA_ENGINEER"

Revoke CREATE CLOUD privilege on an organization from a role

REVOKE CREATE CLOUD  
ON ORG
FROM ROLE "DATA_ENGINEER"