Fix the “access denied” error in Amazon Redshift by granting the right privileges or roles to users.
Redshift returns the error when the current user or role lacks the required privilege on the target object (table, schema, database, or function).The default PUBLIC role has very few rights, so new users often hit this wall.
Query system tables.
SELECT * FROM pg_table_def WHERE schemaname='public' AND tablename='orders';
No rows or null privilege columns signal missing grants.
Use GRANT on the specific object, not the whole database, for least-privilege security.Always qualify the schema name.
GRANT SELECT ON TABLE public.orders TO analyst_role;
GRANT USAGE ON SCHEMA public TO analyst_role;GRANT SELECT,INSERT ON ALL TABLES IN SCHEMA public TO analyst_role;
Reconnect as the user or SET ROLE and rerun the original query.If it succeeds, the privilege set is correct.
• Create roles for job functions (analyst, loader, app).
• Grant rights to roles, not individual users.
• Re-run ALTER DEFAULT PRIVILEGES
after creating new schemas or tables.
Yes.Combine pg_user
and pg_has_role
functions to list users without expected privileges and remediate in bulk.
Add ALTER DEFAULT PRIVILEGES
to deployment scripts so new tables inherit correct rights, removing manual steps.
.
No. Any user with the GRANT OPTION on an object or with the SECURITYADMIN role can grant privileges.
No. It only affects objects created after the command runs. Use explicit GRANT statements for existing tables.
Run REVOKE ALL ON TABLE schema.table FROM role_name; then grant only the required privileges.