SHOW TAGS: Shared Tags Require the READ Privilege on the Tag


This behavior change is in the 2023_05 bundle.

For the current status of the bundle, refer to Bundle History.

The behavior of the SHOW TAGS command with respect to data sharing is as follows:


If a data sharing provider shares a schema that stores tags, the consumer can view all of the shared tags using a SHOW TAGS command provided that the role that executes the SHOW TAGS command has the required privileges to access the shared schema.


As a consumer, to use the SHOW TAGS command to view shared tags, you must use a role that is granted the READ privilege on each tag. The READ privilege for a tag is new and is only applicable in a data sharing context.

The provider chooses how to grant the READ privilege on the tag to the share:

  • Grant the READ privilege on each tag to the share directly.

    GRANT READ ON TAG mytag TO SHARE myshare;
  • Grant the READ privilege on the tag to a database role and grant the database role to the share.

    GRANT READ ON TAG mytag TO DATABASE ROLE mydb.dbrole;
    GRANT DATABASE ROLE mydb.dbrole TO SHARE myshare;

The consumer:

  • Creates a database from the share and grants privileges on the share to account roles (no changes).

  • Grants the database role to an account role (if applicable, no changes).

  • Uses SQL to execute the SHOW TAGS command.

To determine whether you have tags that are affected by the pending behavior, use these commands:

SHOW TAGS IN shared_database;
SHOW TAGS IN shared_schema;

Ref: 1196