topic Re: PERMISSION_DENIED: User is not an owner of Table/Schema in Administration & Architecture

PERMISSION_DENIED: User is not an owner of Table/Schema

bean — Mon, 30 Sep 2024 12:44:58 GMT

Hi,

We have recently added a service principal for running and managing all of our jobs. The service principal has ALL PRIVILEGES to our catalogs/schemas/and table. But we're still seeing the error message `PERMISSION_DENIED: User is not an owner of Table/Schema` popping up.

For example, running:

ALTER TABLE current_name RENAME TO new_name;

Results in:

com.databricks.sql.managedcatalog.acl.UnauthorizedAccessException: PERMISSION_DENIED: User is not an owner of Table current_name

Even though the service principal indicated in the `run_as` user of the job has ALL PRIVILEGES to the catalog/schema/ and table. The only way we managed to fix the issue was to change the owner of the table to be the new service principal.

Is that an expected behavior? I though `modify` permission is enough for altering a table.

Re: PERMISSION_DENIED: User is not an owner of Table/Schema

-werners- — Mon, 30 Sep 2024 14:37:26 GMT

no that is not enough. depending on the operation you want to do you also need ownership.

See here also:
Permissions on Unity Catalog Table Constraints - Databricks Community - 59569

Re: PERMISSION_DENIED: User is not an owner of Table/Schema

bean — Mon, 30 Sep 2024 19:39:58 GMT

Thanks so much for your reply. This makes sense. I wish the alter table documentation https://docs.databricks.com/en/sql/language-manual/sql-ref-syntax-ddl-alter-table.html would have mentioned this explicitly. Because in the Syntax section, it specifies `Alter table {table_name} rename to {new_name}` as a valid syntax but it does not mention that such operations can only be performed by the owner.

Is there somewhere to request documentation updates (beside from the email option via the Feedback button)?

Re: PERMISSION_DENIED: User is not an owner of Table/Schema

-werners- — Tue, 01 Oct 2024 07:36:59 GMT

I think the feedback button is the right place. At least I don't know of another way.