Grants one or more privileges on an external location to a principal. Supports WITH GRANT OPTION for delegated administration.
GRANT <privilege> [, <privilege> ...] ON EXTERNAL LOCATION <name> TO <principal> [WITH GRANT OPTION]## Overview GRANT ON EXTERNAL LOCATION assigns one or more privileges on a location to a single principal. Unlike zone, schema, and table grants which take exactly one privilege, location grants accept a comma-separated list. ## Behavior - The principal is a single name. There is no comma-separated principal list; multiple principals require multiple statements. - WITH GRANT OPTION allows the grantee to issue further grants of the same privileges. The Control Plane authorization layer enforces this at re-grant time. - The grant is recorded for each privilege individually. Revoke them one at a time or all at once with a matching multi-privilege REVOKE. - Dropping the external location removes all grants on it. ## Access Control Requires either the `ManageGrants` privilege on the location, ownership of the location, or a prior grant of the same privilege with WITH GRANT OPTION. ## Compatibility DeltaForge extension.
| Name | Type | Description |
|---|---|---|
privileges | Specifies one or more privileges as a comma-separated list. Common privileges: `READ` (read files through the location), `CREATE_EXTERNAL_LOCATION` (create new locations rooted at this one), `MANAGE`. | |
location_name | Specifies the external location. | |
principal | Specifies the user, role, group, or service principal to grant to. | |
with_grant_option | When true, the grantee may re-grant the same privileges to other principals. |
-- Single privilege
GRANT READ ON EXTERNAL LOCATION raw_data TO ROLE analyst;-- Multiple privileges in one statement
GRANT READ, CREATE_EXTERNAL_LOCATION ON EXTERNAL LOCATION raw_data TO ROLE pipeline_lead;-- With grant option
GRANT READ ON EXTERNAL LOCATION raw_data TO ROLE data_lead WITH GRANT OPTION;