How do I resolve the "user cannot be dropped" error in Amazon Redshift?
I'm unable to drop a user or group in Amazon Redshift. How do I resolve this?
"I'm unable to drop a user or group in Amazon Redshift. How do I resolve this?Short descriptionWhen you try to drop a user in Amazon Redshift, you might encounter one of these error messages:ERROR: user "username" cannot be dropped because some objects depend on itERROR: user "username" cannot be dropped because the user has a privilege on some objectERROR: user "username" cannot be dropped because the user owns some objectThese errors can occur when you try to drop these types of users:Owner or target user of default privileges that were previously granted.Owner of any object (such as databases, schemas, tables, views, procedures, and libraries).User has privileges on the previously mentioned objects.To resolve these error messages, you must first remove any user permissions. Then, you must transfer object ownership, or remove group ownership of the objects.Important: You must revoke user and group permissions from all databases in the Amazon Redshift cluster.ResolutionDropping a userImportant: Before you drop a user, revoke any user permissions. Then, transfer ownership of any database objects owned by the user.1.    Download and install the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts from the AWS Labs GitHub repository. These scripts create views in Amazon Redshift that are useful for the next two steps.Note: The views for the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts use the admin schema in their definition. If you don't have an admin schema created on the Amazon Redshift cluster, then create these views in any other existing schema. To create these views in another schema, modify the definition or create an admin schema. Note that if there are any column changes in your view definition, you must drop your view before creating a new view and definition. If a view already exists and you try to create a new one without dropping the old view, then you receive a "not valid table" error.2.    Find all granted user permissions by user that must be dropped, and then regrant those permissions as another user (superuser preferably):select regexp_replace(ddl,grantor,'<superuser>') from v_generate_user_grant_revoke_ddl where grantor='<username>' and ddltype='grant' and objtype <>'default acl' order by objseq,grantseq;Note: The user that regrants the permissions must be a user with permissions on the object. This user must have grant permissions rights to another user. If there are no other users with regrant permissions, then you can regrant the permissions as a superuser.3.    Find all permissions granted to the user, and then revoke them:select ddl from v_generate_user_grant_revoke_ddl where ddltype='revoke' and (grantee='<username>' or grantor='<username>') order by objseq, grantseq desc;Note: Make sure to replace "grantor" and "grantee" with the user names who can grant and receive permissions, respectively.If your query doesn't return any records or the drop user command fails, then run this query:select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and ddl ilike '%<user-to-be-dropped>%' order by objseq, grantseq desc;This query lists the permissions that must be revoked from the user before the user can be dropped. Make sure to revoke these permissions before proceeding to the next step.4.    Run these queries to check for any empty access control lists (ACLs):select * from pg_user where usename = '<username-to-be-dropped>'; select * from pg_default_acl where defacluser= <user-id>;To retrieve the use name and user ID, find the usename and usesysid column entries in the PG_USER table.Note: You can't drop a user if there are any user entries in the PG_DEFAULT_ACL table.5.    If the user to be dropped still has permissions on some objects, check if the user was granted assume-role permissions. You can do this by using this query :select pg_get_iam_role_by_user('<user-name>');If you see assumerole permissions for the user to be dropped, then revoke them using this command :revoke assumerole on all from <user-name> for all;6.    (Optional) If the user to be dropped still has permissions on some objects, then check if the user is part of another group. The user might have permissions that are granted from that group. Or, the user might have permissions that were granted to the PUBLIC group (or all users).To confirm the permissions that are still granted to the user, run these queries:select * from pg_user where usename = '<username-to-be-dropped>';select * from pg_group;In the output of the second query, check the grolist column and verify whether there are any entries listing the user to be dropped. If the user to be dropped belongs to another group, then the user ID is listed.If your grolist column indicates that the user is part of a group, then check the permissions that are granted to that group:select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and grantee= 'group <group-name>' ;select * from admin.v_generate_user_grant_revoke_ddl where objname='timecards' and schemaname='postgres' and grantee='PUBLIC' and ddltype='revoke';Make sure to replace objname and schemaname with your respective table and schema.Note: By default, permissions granted to the PUBLIC group are granted to all users.7.    Find all objects owned by the user, and then transfer the ownership from the user being dropped to a different user or admin:select ddl||'<newuser>;' as ddl from admin.v_find_dropuser_objs where objowner = '<username-to-be-dropped>';This output lists the commands that you can use to transfer ownership to a new user. Make sure to run the commands that are listed.8.    Repeat steps 2-7 in each database on the Amazon Redshift cluster.9.    Use the DROP USER command to remove the user from the database:drop user <username-to-be-dropped>;Dropping a groupBefore you drop a group, you must revoke any permissions that the group has for objects.1.    Download and install the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts from the AWS Labs GitHub repository. These scripts create views in Amazon Redshift that are useful for the next step.Note: The views for the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts use the admin schema in their definition. If you don't have an admin schema created on the Amazon Redshift cluster, then you can create these views in any other existing schema. To create these views in another schema, modify the definition or create an admin schema.2.    Find all permissions granted to the group, and then revoke them, as shown in this example:select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and grantee= 'group <group-name>';3.    Repeat step 2 in each database on the Amazon Redshift cluster, confirming that the group's permissions are revoked in all databases.4.    Use the DROP GROUP command to remove the user group.Related informationDROP USER usage notesDROP GROUP exampleFollow"