POST_START

Investigating Unauthorized View Creation in a Production Schema

Today, I was tasked with investigating an unusual access pattern in our production environment. A view had been created in the production.reporting schema without prior approval, and I needed to trace how it happened. I started by checking what views were defined in that schema.

SHOW VIEWS IN production.reporting;

I saw a representative result like this:

namespace	viewName	isTemporary
reporting	daily_sales	false

The view daily_sales existed, but I didn’t recall any team requesting it. I wanted to understand who had access to create views in that schema, so I checked the grants assigned to the production.reporting schema.

SHOW GRANTS ON SCHEMA production.reporting;

I saw a representative result like this:

principal	actionType	objectType
data_analysts	USE SCHEMA	SCHEMA
data_engineers	CREATE TABLE	SCAMIL

According to the grants, the data_engineers group had the CREATE TABLE privilege, which typically includes the ability to create views. The data_analysts only had USE SCHEMA, which doesn’t allow view creation. This raised a red flag—I needed to confirm if someone had created the view without proper authorization.

To trace the origin of the view creation, I turned to the audit logs. I queried the system.access.audit table for events related to the production.reporting schema.

SELECT * FROM system.access.audit WHERE request_params LIKE '%production.reporting%' ORDER BY event_time DESC;

I saw a representative result like this:

event_time	user_identity	action_name	request_params
2026-09-11 14:32:10	analyst@demo.com	commandSubmit	{table: production.sales.customers}
2026-09-11 14:31:55	engineer@demo.com	getTable	{table: production.sales.customers}

The latest event was from engineer@demo.com, who had executed a commandSubmit that likely included the creation of the daily_sales view. This suggested that the view was created by an engineer, possibly without proper approval.

I verified that the engineer@demo.com user was part of the data_engineers group, which had the CREATE TABLE privilege. While this privilege is typically intended for tables, it can also allow view creation. This was a potential security oversight—granting CREATE TABLE on a schema might inadvertently allow view creation without explicit permission.

With this information, I was able to inform the team that the daily_sales view was created without proper authorization and that we should review the access controls for the production.reporting schema to prevent similar incidents in the future.