Introduction
This document outlines the various master user security permissions available for the Tessell for SQL Server database service. Tessell provides the below permissions for one “master“ login to perform specific actions and operations within the database environment. Below is a list of permissions along with a brief description of each.
Roles Granted
ADMINISTER BULK OPERATIONS: This permission enables the master user to execute bulk import and export operations, facilitating efficient data movement in and out of the database.
ALTER ANY CREDENTIAL: With this permission, the master user can modify any existing credentials, which are used for authenticating external resources.
ALTER ANY EVENT SESSION: The master user can modify or alter any event session, controlling the capturing of specific events for analysis and troubleshooting.
ALTER ANY LINKED SERVER: This permission allows the master user to modify configurations and properties of linked servers, facilitating communication between different database instances.
ALTER ANY LOGIN: The master user can create and modify login credentials and properties for database access, ensuring control over user authentication.
ALTER ANY SERVER AUDIT: With this permission, the master user can modify server audit configurations, enabling tracking and monitoring of specific database activities.
ALTER ANY SERVER ROLE: The master user can modify server roles and their permissions, regulating user access and privileges at the server level.
ALTER TRACE: The master user can enable and manage trace configurations, allowing detailed monitoring of query execution and performance.
CONNECT SQL: With this permission, the master user can establish connections to the SQL Server instance, a fundamental requirement for accessing the database.
CREATE ANY DATABASE: The master user can create new databases within the SQL Server instance, facilitating the setup of new application environments.
VIEW ANY DATABASE: This permission allows the master user to view metadata and information about all databases within the SQL Server instance.
VIEW ANY DEFINITION: The master user can access the definitions of database objects, helping with understanding and analysis of the database structure.
VIEW SERVER STATE: This permission enables the master user to view detailed information about the SQL Server instance's current state and performance metrics.
ALTER ROLE: The master user can modify roles within the database, regulating user access and permissions at the database level.
SQLAgentOperatorRole: This role grants the master user the necessary permissions to manage and operate SQL Server Agent jobs and schedules. This is in the context of msdb
db_datareader : This is in the context of the master database
GRANT SHOWPLAN : Users who have SHOWPLAN permission can view queries that are captured in Showplan output. These queries may contain sensitive information such as passwords. Therefore, it is recommended that you only grant these permissions to users who are authorized to view sensitive information.
These master user security permissions provide fine-grained control over various aspects of the Tessell MSSQL Service offering, ensuring secure and efficient management of the database environment. It is essential to assign these permissions carefully based on the specific roles and responsibilities of the users.
Roles Not Granted
The following server roles will not be granted as part of the MSSQL database as a service offering. These roles involve elevated privileges that could potentially compromise the security and stability of the database environment.
bulkadmin: This role allows users to execute BULK INSERT statements, which can significantly impact data integrity and security.
dbcreator: The dbcreator role permits users to create, alter, and drop databases. Assigning this role could lead to unintended database proliferation and modification. We are controlling this access via server-level trigger
diskadmin: Users with the diskadmin role can manage disk files and configurations. This role could result in unauthorized modifications to storage settings.
securityadmin: The securityadmin role grants users the ability to manage logins, server-level permissions, and endpoint configurations, which could compromise security controls.
serveradmin: This role allows users to configure server-wide settings and options, potentially affecting the entire SQL Server instance.
sysadmin: The sysadmin role provides users with unrestricted administrative access to the SQL Server instance, including all databases and settings. Granting this role could result in unauthorized system changes.
Excluding these roles from the permissions ensures a controlled and secure environment for the MSSQL database as a service offering. Users will have the necessary permissions to perform their designated tasks without compromising the integrity and stability of the database system.
Requesting Additional Permissions
If customers using the MSSQL database A service offering require permissions beyond those outlined in this documentation, they have the option to request additional permissions. To initiate this process, customers are advised to contact the Tessell support team, who will guide them through the necessary steps.
Process Overview
Contact Tessell Support Team: Customers should reach out to the Tessell support team to express their need for additional permissions. This initial contact will kick-start the process.
Risk Assessment: Upon receiving the customer's request, the Tessell team will conduct a thorough risk assessment. This assessment will evaluate the potential security and operational implications of granting the requested permissions.
Permission Evaluation: Based on the risk assessment, the Tessell team will evaluate the feasibility of granting the requested permissions. This evaluation will take into account factors such as security, compliance, and impact on the database environment.
Communication and Approval: The Tessell team will communicate the results of the evaluation to the customer. If the requested permissions are deemed appropriate and can be granted without compromising the security and stability of the environment, approval will be granted.
Permission Provisioning: Upon approval, the Tessell team will proceed to provision the additional permissions to the customer's designated master user or users. This provisioning will be done in a controlled manner to ensure that security and operational standards are maintained.
It's important to note that the process of requesting and granting additional permissions involves a comprehensive risk assessment to safeguard the integrity of the database environment. This approach ensures that the security and performance of the MSSQL database A service offering remain at optimal levels.
By following this process, customers can collaborate with the Tessell support team to tailor the permissions to their specific requirements while adhering to best practices for security and database management.