1

I have a developer who has created a set of procedures/functions/views he uses to perform configuration analysis in a large application (provides much higher productivity than using the formal application UI).

The plan is to deploy these procedures into the production environment into an isolated schema named [CONFIG_ANALYSIS], as well as granted EXEC and SELECT permissions to the superuser within this schema, as well as db_datareader. This user will not have insert, update, delete permissions as they should not be altering data via the backend.

It would be preferable if the developer was able to modify and create new procedures within this schema:

GRANT CREATE PROCEDURE TO [UserName];  
GRANT ALTER ON SCHEMA::[CONFIG_ANALYSIS] TO [UserName];

Is there any risk (even theoretical) in allowing this ability to modify and create new procedures within this isolated schema? (Performance issues excluded, as the decision has already been made to allow adhoc queries and select procedures to be executed).

2
  • I think this post might cover some of your questions: stackoverflow.com/a/3132876/6220816
    – Arthur D
    Apr 26, 2016 at 20:57
  • @ArthurD Thanks, that does provide some additional insight. To me this scenario seems possible, and safe, but I have no way of knowing if there's something obscure I'm missing.
    – tbone
    Apr 26, 2016 at 21:24

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.