The DBMS IMPERSONATE privileges
AuraDB Business CriticalAuraDB Virtual Dedicated CloudEnterprise Edition

The DBMS privileges for impersonation can be granted, denied, or revoked like other privileges.

Impersonation is the ability of a user to assume another user’s roles (and therefore privileges), with the restriction of not being able to execute updating admin commands as the impersonated user (i.e. they would still be able to use SHOW commands).

You can use the IMPERSONATE privilege to allow a user to impersonate another user.

For more details about the syntax descriptions, see Reading the administration commands syntax.
Table 1. Impersonation privileges command syntax
Command Description 
GRANT [IMMUTABLE] IMPERSONATE [(*)]
    ON DBMS
    TO role[, ...]

Enables the specified roles to impersonate any user.

 
GRANT [IMMUTABLE] IMPERSONATE (user[, ...])
    ON DBMS
    TO role[, ...]

Enables the specified roles to impersonate the specified users.

Grant privilege to impersonate all users

You can grant the privilege to impersonate all users using the IMPERSONATE (*) privilege.
For example:

Query
GRANT IMPERSONATE (*) ON DBMS TO allUserImpersonator

As a result, the allUserImpersonator role has privileges that allow impersonating all users. To list all privileges for the role allUserImpersonator as commands, use the following query:

Query
SHOW ROLE allUserImpersonator PRIVILEGES AS COMMANDS;
Table 2. Result
command

"GRANT IMPERSONATE (*) ON DBMS TO `allUserImpersonator`"

Rows: 1

Grant privilege to impersonate specific users

You can also grant the privilege to impersonate specific users or a subset of users.
For example:

Query
GRANT IMPERSONATE (alice, bob) ON DBMS TO userImpersonator;

As a result, the userImpersonator role has privileges that allow impersonating only alice and bob. Then, you deny the privilege to impersonate alice:

Query
DENY IMPERSONATE (alice) ON DBMS TO userImpersonator;

As a result, the userImpersonator user would be able to impersonate only bob.

To list all privileges for the role userImpersonator as commands, use the following query:

Query
SHOW ROLE userImpersonator PRIVILEGES AS COMMANDS;
Table 3. Result
command

"DENY IMPERSONATE (alice) ON DBMS TO `userImpersonator`"

"GRANT IMPERSONATE (alice) ON DBMS TO `userImpersonator`"

"GRANT IMPERSONATE (bob) ON DBMS TO `userImpersonator`"

Rows: 3