joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Developer] #567 use backoffice account for SQL evidence

Browse Source
This commit is contained in:
devmrko
2026-07-01 14:59:22 +09:00
parent 064a5bc31d
commit 1c66b973a7
5 changed files with 21 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
sql/adb/34_agent_ords_execution_evidence_grant.sql
View File

@@ -4,20 +4,25 @@
--
-- Run as SYS or a DBA account that can grant SYS.V_$ dynamic-performance
-- views. Typical Autonomous ADMIN accounts cannot delegate these views.
-- The grants are read-only and scoped to the ORDS parsing schema. They do
-- not grant table DML or alter DBMS_RLS enforcement.
-- The grants are read-only and scoped to the BACKOFFICE_DB_USERNAME account
-- that displays the evidence (for example, ADMIN). They do not grant table
-- DML or alter DBMS_RLS enforcement.
-- ============================================================
WHENEVER SQLERROR EXIT SQL.SQLCODE
SET ECHO ON
SET FEEDBACK ON
PROMPT === Granting ORDS cursor-evidence read access ===
GRANT SELECT ON V_$SQL TO CB_ORDS;
GRANT SELECT ON V_$SQL_PLAN TO CB_ORDS;
GRANT SELECT ON V_$SQL_PLAN_STATISTICS_ALL TO CB_ORDS;
GRANT SELECT ON V_$SESSION TO CB_ORDS;
GRANT EXECUTE ON DBMS_XPLAN TO CB_ORDS;
-- Change ADMIN when BACKOFFICE_DB_USERNAME uses a dedicated observer account.
DEFINE diagnostic_user = ADMIN
PROMPT === ORDS cursor-evidence grants ready ===
PROMPT === Granting backoffice cursor-evidence read access ===
GRANT SELECT ON V_$SQL TO &diagnostic_user;
GRANT SELECT ON V_$SQL_PLAN TO &diagnostic_user;
GRANT SELECT ON V_$SQL_PLAN_STATISTICS_ALL TO &diagnostic_user;
GRANT SELECT ON V_$SESSION TO &diagnostic_user;
GRANT EXECUTE ON DBMS_XPLAN TO &diagnostic_user;
PROMPT === Backoffice cursor-evidence grants ready ===
PROMPT SQL_ID evidence will appear after the next /probe call.
UNDEFINE diagnostic_user
EXIT;