HANA Studio Authorization for Administration Tasks Flashcards
To perform administration tasks in the SAP HANA studio, you require certain privileges and/or roles. These must be granted to your database user or relevant role by a user administrator.
Required Authorization for task: Open the SAP HANA Administration Console perspective with read-only access to the system tables and monitoring views.
System privilege CATALOG READ
Required Authorization for task: View alert information
Object privilege SELECT on the schema _SYS_STATISTICS
Required Authorization for task: View system information in the System Monitor
System privilege CATALOG READ and object privilege SELECT on the schema _SYS_STATISTICS
Required Authorization for task: Open the Web-browser-based Monitoring Dashboard
Role sap.hana.admin.roles::Monitoring
Required Authorization for task: Monitor table distribution in the Table Distribution editor
System privilege CATALOG READ
Required Authorization for task: Open the Web-browser-based editors Resource Utilization, Memory Overview, and Memory Allocation Statistics
Role sap.hana.admin.roles::Monitoring
Required Authorization for task: Stop, start, restart system
Operating system user (adm) credentials
Required Authorization for task: Stop and start database services
System privilege SERVICE ADMIN
Required Authorization for task: Cancel operations
System privilege SESSION ADMIN
Required Authorization for task: Mark disk-full events as handled
System privilege MONITOR ADMIN
Required Authorization for task: Change the properties of a system as defined in the parameters of the configuration (*.ini) files
System privilege INIFILE ADMIN
Required Authorization for task: Configure system checks (e-mail notification, alter thresholds)
System privilege INIFILE ADMIN
Required Authorization for task: Execute table redistribution operations
System privilege RESOURCE ADMIN and at least the object privilege ALTER for all schemas involved
Required Authorization for task: Configure hosts for auto-failover
RESOURCE ADMIN
Perform a delta merge operation on a table (manually)
Object privilege UPDATE for the table
Compress a table
Object privilege UPDATE for the table
Manually move tables and table partitions to another host in a distributed system
Object privilege ALTER for the table
Partition a non-partitioned table
Object privileges ALTER and UPDATE for the table
Change a partitioned table into a non-partitioned table by merging all partitions
Object privilege ALTER for the table
Import catalog objects
Depending on the import, object privilege INSERT/UPDATE, DROP, and CREATE for the catalog objects in question
Export catalog objects
Object privilege SELECT for the catalog objects in question
Check license information
System privilege LICENSE ADMIN
Install and delete license keys
System privilege LICENSE ADMIN
Configure traces (except kernel profiler)
System privilege TRACE ADMIN
Configure kernel profiler
Standard role SAP_INTERNAL_HANA_SUPPORT
Delete trace files
System privilege TRACE ADMIN
Troubleshoot offline system (including access diagnosis files) using Administrator editor diagnosis mode
Operating system user (<sid>adm) credentials</sid>
Create, change, and delete users
System privilege USER ADMIN
Create, change, and delete roles in runtime
System privilege ROLE ADMIN
Grant and revoke privileges/roles to/from users and roles
To grant SQL privileges and roles, you must have the privilege and/or role yourself and be authorized to grant it to others. To grant privileges on activated repository objects, you must be authorized to execute certain stored procedures.
Configure the password policy and the password blacklist
System privilege INIFILE ADMIN and object privileges INSERT and DELETE for either the _SYS_PASSWORD_BLACKLIST table or the _SYS_SECURITY schema
View procedures and calculation views in the authorization dependency viewer
System privilege CATALOG ADMIN
Activate and configure auditing
System privilege AUDIT ADMIN or AUDIT OPERATOR or INIFILE ADMIN
Create and manage audit policies
System privilege AUDIT ADMIN or AUDIT OPERATOR
Read the audit trail database table SYS.AUDIT_LOG
System privilege AUDIT OPERATOR
Delete entries from the audit trail
System privilege AUDIT OPERATOR
Enable persistence encryption and access the encryption monitoring views M_PERSISTENCE_ENCRYPTION_STATUS and M_PERSISTENCE_ENCRYPTION_KEYS
System privilege RESOURCE ADMIN
Change the page encryption key used for data volume encryption and re-encrypt the data
System privilege RESOURCE ADMIN
Perform backups
BACKUP ADMIN and CATALOG READ or BACKUP OPERATOR and CATALOG READ
Open the Backup editor
BACKUP ADMIN and CATALOG READ
Delete data and log backups from the backup catalog and physically from the backup location
BACKUP ADMIN
Recover
Operating system user (<sid>adm) credentials</sid>
