POST_START
Investigating Unauthorized Table Creation in a Production Schema
I recently noticed some unusual activity in our production environment. A table had been created in the production.sales schema that wasn’t part of our standard data model. My job was to figure out how it got there and whether it was an accident or a security breach. I started by checking what tables were present in that schema.
SHOW TABLES IN production.sales;
I saw a representative result like this:
| database | tableName | isTemporary |
|---|---|---|
| sales | customers | false |
| sales | orders | false |
I noticed that the customers table was listed, which was part of our existing schema. But there was no sign of the new table that had been reported. I realized I needed to look into the access controls for the production.sales schema to see who had permissions to create tables there.
SHOW GRANTS ON SCHEMA production.sales;
I saw a representative result like this:
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE SCHEMA | SCHEMA |
| data_engineers | CREATE TABLE | SCHEMA |
This showed that the data_engineers group had the CREATE TABLE permission on the schema. That meant they could create tables there, but it didn’t tell me who actually did it. I needed to check the audit logs to find the exact event.
SELECT * FROM system.access.audit WHERE request_params LIKE '%production.sales%' ORDER BY event_time DESC;
I saw a representative result like this:
| event_time | user_identity | action_name | request_params |
|---|---|---|---|
| 2026-09-11 14:32:10 | analyst@demo.com | commandSubmit | {table: production.sales.customers} |
| 2026-09-11 14:31:55 | engineer@demo.com | getTable | {table: production.sales.customers} |
From the audit log, I noticed that the commandSubmit action was performed by analyst@demo.com at 14:32:10. This action likely corresponds to a CREATE TABLE command, even though the request_params only mentioned the table name. I verified that the customers table was created by this user, and it wasn’t part of our standard schema.
Based on the audit logs, I concluded that the unauthorized table creation was likely a mistake or a security oversight. The user had access to create tables in the schema, but the table wasn’t part of our intended data model. I reported this to the security team and initiated a review of access controls to ensure that only authorized users could create tables in production schemas.
Leave a Reply