HiveBrain v1.2.0
Get Started
← Back to all entries
patternsqlMinor

SQL Server database level roles for creating tables

Submitted by: @import:stackexchange-dba··
0
Viewed 0 times
tablessqllevelrolescreatingdatabaseforserver

Problem

Is there a way to create or change a special role for creating tables? Our software developer team has db_datareader and db_datawriter roles but they can not create new tables.

I read this article related to database level roles. I don't want to grant db_ddladmin role because there is too much permissions in this role.

So my question is how can i give creating and deleting tables permissions for a database? Views, procedures and functions are okay too. All I need is I don't want to grant permissions related to security, login or backup operations.

Solution

If you want to create a role with specific rights, you could do this:

CREATE ROLE CreateObjects
GRANT CREATE TABLE TO CreateObjects
GRANT CREATE VIEW TO CreateObjects
GRANT CREATE FUNCTION TO CreateObjects
GRANT CREATE PROCEDURE TO CreateObjects
GRANT ALTER ANY SCHEMA TO CreateObjects


Create the test user:

CREATE LOGIN testlogin with password = 'StrongP@SSWORD123'

CREATE USER Testlogin FOR LOGIN Testlogin


Add the user to the role:

ALTER ROLE CreateObjects ADD MEMBER Testlogin


Test the user's permissions:

EXECUTE AS LOGIN = 'testlogin'

SELECT SUSER_NAME(),USER_NAME()

(No column name)    (No column name)
testlogin   Testlogin

CREATE TABLE dbo.test(id int)

DROP TABLE dbo.test 
REVERT


Result

Commands completed successfully.


Or like Tom stated, add the user to the db_ddladmin role.

ALTER ROLE db_ddladmin ADD MEMBER testlogin

Code Snippets

CREATE ROLE CreateObjects
GRANT CREATE TABLE TO CreateObjects
GRANT CREATE VIEW TO CreateObjects
GRANT CREATE FUNCTION TO CreateObjects
GRANT CREATE PROCEDURE TO CreateObjects
GRANT ALTER ANY SCHEMA TO CreateObjects
CREATE LOGIN testlogin with password = 'StrongP@SSWORD123'

CREATE USER Testlogin FOR LOGIN Testlogin
ALTER ROLE CreateObjects ADD MEMBER Testlogin
EXECUTE AS LOGIN = 'testlogin'

SELECT SUSER_NAME(),USER_NAME()

(No column name)    (No column name)
testlogin   Testlogin


CREATE TABLE dbo.test(id int)

DROP TABLE dbo.test 
REVERT
Commands completed successfully.

Context

StackExchange Database Administrators Q#225359, answer score: 9

Revisions (0)

No revisions yet.