80 lines
1.8 KiB
Transact-SQL
80 lines
1.8 KiB
Transact-SQL
/*
|
|
This script setups the needed permissions to enable Triapharm devops pipeline access to
|
|
Triapharm databases
|
|
|
|
The permissions assigned are:
|
|
Server level:
|
|
* ALTER ANY DATABASE
|
|
* ##MS_DatabaseManager##
|
|
* ##MS_ServerPerformanceStateReader##
|
|
* ##MS_ServerStateReader##
|
|
*/
|
|
|
|
USE master
|
|
GO
|
|
|
|
-- Check if the login exists, if not, create it
|
|
IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N'sqlLogin-db-pipeline')
|
|
BEGIN
|
|
CREATE LOGIN [sqlLogin-db-pipeline] WITH PASSWORD = N'tzJcO,O8S~k~u^zR6!JL';
|
|
END
|
|
ELSE
|
|
BEGIN
|
|
ALTER LOGIN [sqlLogin-db-pipeline] WITH PASSWORD = N'tzJcO,O8S~k~u^zR6!JL';
|
|
END
|
|
GO
|
|
|
|
-- Grant access to DMVs
|
|
GRANT VIEW SERVER STATE TO [sqlLogin-db-pipeline];
|
|
|
|
GO
|
|
|
|
DECLARE @q NVARCHAR(MAX) = '
|
|
USE ?
|
|
IF EXISTS(
|
|
SELECT *
|
|
FROM sys.databases d
|
|
WHERE d.name = DB_NAME()
|
|
AND (
|
|
[d].[source_database_id] IS NULL
|
|
AND [d].[is_read_only] = 0
|
|
AND [d].[is_in_standby] = 0
|
|
AND [d].[state] = 0 --online
|
|
)
|
|
)
|
|
|
|
BEGIN
|
|
IF DB_NAME() NOT IN (''master'',''tempdb'',''model'')
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT * FROM ?.sys.database_principals WHERE name = N''sqlLogin-db-pipeline'')
|
|
BEGIN
|
|
CREATE USER [sqlLogin-db-pipeline] FOR LOGIN [sqlLogin-db-pipeline];
|
|
END
|
|
END
|
|
|
|
IF DB_NAME() = ''msdb''
|
|
BEGIN
|
|
--allow jobs creation / modification / deletion
|
|
ALTER ROLE [SQLAgentOperatorRole] ADD MEMBER [sqlLogin-db-pipeline];
|
|
|
|
END
|
|
|
|
IF DB_NAME() NOT IN (''master'',''msdb'',''tempdb'',''model'')
|
|
BEGIN
|
|
--give permission to alter / create / drop objects in db
|
|
ALTER ROLE [db_ddladmin] ADD MEMBER [sqlLogin-db-pipeline];
|
|
|
|
-- Grant permissions for change tracking and broker management
|
|
GRANT ALTER ON DATABASE::[?] TO [sqlLogin-db-pipeline];
|
|
|
|
|
|
END
|
|
END
|
|
'
|
|
EXEC sys.sp_MSforeachdb @command1 = @q
|
|
|
|
|
|
|
|
|
|
|