managing subaccount access?

[pmichaud]

I am interested in delegating access to Canvas hosted data via subaccounts.  E.g. giving the English department access to all data for English courses.  From what I've seen of the tables so far, I should be able to create views that derive subtables based on linking back through the course_dim and account_dim tables.

The one piece that's missing is the ability to create psql accounts for users.  Is it possible to add an account that rights to create accounts and grant read access on views?

As a bigger question - is this a bad idea, and are there any plans to support something like this in a central way?

[msmith · Accepted solution]

Patrick,

We plan to support this type of functionality in the next version of hosted-data.

[pmichaud]

That sounds great.  Do you have an outline of how we might work with that as an institution? 

[msmith]

We have not designed the feature yet.   We will definitely take your feedback above into account.  We may not grant access to a Redshift admin as we would like to manage all access to that data via our security portal (release upcoming).  We have had multiple people ask for the ability to grant more fine grained access to the data and this is an important feature for v2.

Also, FYI in the V1 timeframe we are planning to denormalize the transitive closure of all related foreign keys into all the tables.   What that means is that basically we will push the account_id (and other ids) in to all the tables it could be related to even if it is via multiple joins.   This should make the data a little easier to partition if you wanted to rehost the data.  

[brenden_goetz]

Just curious if this v2 feature of delegating access on a subaccount level still in the works. We have received similar requests from schools/colleges on campus, and are working out a way to do this.

Until that feature arrives, how are folks handling these types of access requests? Pulling all the data into their own data warehouses and providing access via views?

Thanks!