注册表

概述

要在协作中使用模板或数据产品等资源，必须先在注册表中注册。注册表是一个账户级容器，旨在存储这些资源。注册后，账户中的任何用户只要同时拥有注册表的访问权限和该特定协作的必要链接权限，即可将注册表中的资源链接到该协作。值得注意的是，注册表独立于特定的协作；注册资源可以关联到该账户中任意数量的协作，也可以完全不进行关联。

Each Snowflake account supports a default registry. You can create additional custom registries for your account. Custom registries are a good way to group and manage access to your resources. For example, you could create a custom registry for sales data and another for expenditure data, then grant access to these registries to the appropriate users via DCR privileges and custom RBAC roles.

注册表规则

以下是关于注册表的主要规则：

  • Registries are account-level objects. Users can see and access only registries in their own account. However, when a resource in a registry is linked into a collaboration, the resource is visible to anyone who can access it according to the spec. Access to the containing registry isn’t required.
  • Each custom registry supports a single resource type (template, data offering, and so on). The resource type is specified when you create the registry. The default registry supports any resource type.
  • 在一个账户中，您可以创建的自定义注册表数量没有限制。
  • When you register a resource, you can use the optional registry name parameter to specify a custom registry. If you don’t specify a custom registry, the resource is registered in the default registry for the account.
  • All users have access to the default registry in an account. Custom registries, however, are initially private to the creator, and additional users must be granted access explicitly by calling GRANT_PRIVILEGE_ON_OBJECT_TO_ROLE.
  • 一个账户可以有多个存储相同资源类型的注册表。
  • 注册表对资源数量没有最大限制。
  • A resource must have a unique name across all registries in that account for resources of that type. For example, you can have a template named sales and a data offering named sales in the same account, but not two templates named sales in either the same or different registries in the same account. The resource name is defined as the highest-level name value in the spec.
  • If two different accounts link resources with the same name and type to a collaboration, that is allowed. The collaboration specification will show identically named resources, but the system will know which resource is intended — the resource with that name is used from the account that linked the resource to the collaboration.

示例

该示例创建一个自定义注册表，在其中注册一个模板，并向新角色授予该注册表的读取访问权限。拥有该角色的用户可将该注册表中的模板链接到协作中。

-- Create a custom registry that can hold templates.
CALL SAMOOHA_BY_SNOWFLAKE_LOCAL_DB.REGISTRY.CREATE_REGISTRY(
  'SALES',
  'TEMPLATE'
);

CALL SAMOOHA_BY_SNOWFLAKE_LOCAL_DB.REGISTRY.REGISTER_TEMPLATE(
'SALES',
$$
api_version: 2.0.0
spec_type: template
name: alice_only_template
version: v1
type: sql_analysis
description: Joins two tables on hashed email and counts matches grouped by status.
template:
  SELECT t1.status, COUNT(*)
    FROM IDENTIFIER( {{ source_table[0] }} ) AS t1
    JOIN IDENTIFIER( {{ source_table[1] }} ) AS t2
    ON t1.hashed_email_b64_encoded = t2.hashed_email_b64_encoded
    GROUP BY t1.status;
$$
);

-- Create a role and grant it access to the registry.
CREATE ROLE MARKETING_USERS;
CALL SAMOOHA_BY_SNOWFLAKE_LOCAL_DB.ADMIN.GRANT_PRIVILEGE_ON_OBJECT_TO_ROLE(
  'READ',
  'REGISTRY',
  'SALES',
  'MARKETING_USERS'
);

-- Grant access to the registry for a user by assigning the role.
GRANT ROLE MARKETING_USERS to USER willy_loman;