Access control: DESCRIBE command no longer uses TAG_ASSOCIATION and GRANT_MANAGEMENT privileged access operations (Pending)¶

DESCRIBE commands (for example, DESCRIBE TABLE, DESCRIBE FUNCTION) no longer use the TAG_ASSOCIATION and GRANT_MANAGEMENT privileged access operations to resolve objects.

Before the change:

The TAG_ASSOCIATION privileged access operation (associated with the APPLY TAG ON ACCOUNT privilege) and the GRANT_MANAGEMENT privileged access operation (associated with the MANAGE GRANTS privilege) were included as privileged access paths for DESCRIBE commands. This allowed roles with MANAGE GRANTS or APPLY TAG ON ACCOUNT to describe objects they otherwise lacked explicit access to, as long as the object could be resolved through one of those operations.

After the change:

DESCRIBE commands no longer use TAG_ASSOCIATION or GRANT_MANAGEMENT as privileged access paths. A role must have explicit access to an object (for example, OWNERSHIP, USAGE, or REFERENCES) to describe it, regardless of whether the role holds MANAGE GRANTS or APPLY TAG ON ACCOUNT.

This change is being made to prevent roles from describing objects outside their intended access scope through account-level administrative privileges.

Ref: 2339