SHOW RESTRICTED SESSION SCOPES¶

Lists restricted session scope objects for which you have access privileges, including the creation date, database and schema names, owner, and any available comments. The definition body isn’t included; use DESCRIBE RESTRICTED SESSION SCOPE to return the YAML.

RSS is a shorthand alias for RESTRICTED SESSION SCOPES. You can use either form in this statement.

See also:: CREATE RESTRICTED SESSION SCOPE , ALTER RESTRICTED SESSION SCOPE , DROP RESTRICTED SESSION SCOPE , DESCRIBE RESTRICTED SESSION SCOPE

Syntax¶

SHOW { RESTRICTED SESSION SCOPES | RSS }
  [ LIKE '<pattern>' ]
  [ IN { ACCOUNT | DATABASE [ <database_name> ] | SCHEMA [ <schema_name> ] } ]

Parameters¶

LIKE 'pattern'

Optionally filters the command output by object name. The filter uses case-insensitive pattern matching, with support for SQL wildcard characters (% and _).

For example, the following patterns return the same results:

... LIKE '%testing%' ... ... LIKE '%TESTING%' ...

Default: No value (no filtering is applied to the output).

[ IN ... ]

Optionally specifies the scope of the command. Specify one of the following:

ACCOUNT

Returns records for the entire account.

DATABASE, DATABASE db_name

Returns records for the current database in use or for a specified database (db_name).

If you specify DATABASE without db_name and no database is in use, the keyword has no effect on the output.

Note

Using SHOW commands without an IN clause in a database context can result in fewer than expected results.

Objects with the same name are only displayed once if no IN clause is used. For example, if you have table t1 in schema1 and table t1 in schema2, and they are both in scope of the database context you’ve specified (that is, the database you’ve selected is the parent of schema1 and schema2), then SHOW TABLES only displays one of the t1 tables.

SCHEMA, SCHEMA schema_name

Returns records for the current schema in use or a specified schema (schema_name).

SCHEMA is optional if a database is in use or if you specify the fully qualified schema_name (for example, db.schema).

If no database is in use, specifying SCHEMA has no effect on the output.

If you omit IN ..., the scope of the command depends on whether the session currently has a database in use:

If a database is currently in use, the command returns the objects you have privileges to view in the database. This has the same effect as specifying IN DATABASE.
If no database is currently in use, the command returns the objects you have privileges to view in your account. This has the same effect as specifying IN ACCOUNT.

Access control requirements¶

A role used to execute this SQL command must have at least one of the following privileges at a minimum:

Privilege	Object
USAGE, MODIFY, or OWNERSHIP	Restricted session scope

Operating on an object in a schema requires at least one privilege on the parent database and at least one privilege on the parent schema.

For instructions on creating a custom role with a specified set of privileges, see Creating custom roles.

For general information about roles and privilege grants for performing SQL actions on securable objects, see Overview of Access Control.

Usage notes¶

The command doesn’t require a running warehouse to execute.
The command only returns objects for which the current user’s current role has been granted at least one access privilege.
The MANAGE GRANTS access privilege implicitly allows its holder to see every object in the account. By default, only the account administrator (users with the ACCOUNTADMIN role) and security administrator (users with the SECURITYADMIN role) have the MANAGE GRANTS privilege.

To post-process the output of this command, you can use the pipe operator (->>) or the RESULT_SCAN function. Both constructs treat the output as a result set that you can query.

For example, you can use the pipe operator or RESULT_SCAN function to select specific columns from the SHOW command output or filter the rows.

When you refer to the output columns, use double-quoted identifiers for the column names. For example, to select the output column type, specify SELECT "type".

You must use double-quoted identifiers because the output column names for SHOW commands are in lowercase. The double quotes ensure that the column names in the SELECT list or WHERE clause match the column names in the SHOW command output that was scanned.

Output¶

The output of the command includes the following columns, which describe the properties and metadata of the object:

Column	Description
`created_on`	Date and time when the restricted session scope was created.
`name`	Name of the restricted session scope.
`database_name`	Database that contains the restricted session scope.
`schema_name`	Schema that contains the restricted session scope.
`owner`	Role that owns the restricted session scope.
`comment`	Comment for the restricted session scope, if any.
`owner_role_type`	The type of role that owns the object, either `ROLE` or `DATABASE_ROLE`.

Examples¶

SHOW RESTRICTED SESSION SCOPES IN SCHEMA mydb.governance;

SHOW RSS LIKE 'analytics%' IN SCHEMA analytics_db.public;