From 3b0c634a2f24128d3ea807717d1068823a06a90b Mon Sep 17 00:00:00 2001 From: Corydon Baylor Date: Tue, 10 Feb 2026 19:55:51 -0500 Subject: [PATCH 1/6] updated fraud --- .../pages/neo4j-fraud.adoc | 77 ++++++++----------- 1 file changed, 34 insertions(+), 43 deletions(-) diff --git a/modules/snowflake-analytics/pages/neo4j-fraud.adoc b/modules/snowflake-analytics/pages/neo4j-fraud.adoc index 11e3ad72..a97800a3 100644 --- a/modules/snowflake-analytics/pages/neo4j-fraud.adoc +++ b/modules/snowflake-analytics/pages/neo4j-fraud.adoc @@ -83,17 +83,6 @@ image:followalong.png[] ==== Permissions -Before we run our algorithms, we need to set the proper permissions. But -before we get started granting different roles, we need to ensure that -you are using `accountadmin` to grant and create roles. Lets do that -now: - -[source,sql] ----- --- you must be accountadmin to create role and grant permissions -use role accountadmin; ----- - Next let’s set up the necessary roles, permissions, and resource access to enable Graph Analytics to operate on data within the `p2p++_++demo.public schema`. It creates a consumer role @@ -106,40 +95,42 @@ pool and warehouse resources needed to run graph algorithms at scale. [source,sql] ---- -USE SCHEMA P2P_DEMO.PUBLIC; - --- Create a consumer role for users and admins of the Neo4j Graph Analytics application -CREATE ROLE IF NOT EXISTS gds_user_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role; - -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role; -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; - --- Grant access to consumer data -GRANT USAGE ON DATABASE P2P_DEMO TO ROLE gds_user_role; -GRANT USAGE ON SCHEMA P2P_DEMO.PUBLIC TO ROLE gds_user_role; - --- Required to read tabular data into a graph -GRANT SELECT ON ALL TABLES IN DATABASE P2P_DEMO TO DATABASE ROLE gds_db_role; - --- Ensure the consumer role has access to created tables/views -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE TABLE ON SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE VIEW ON SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE gds_db_role; - --- Compute and warehouse access -GRANT USAGE ON WAREHOUSE GDSONSNOWFLAKE TO APPLICATION neo4j_graph_analytics; ----- +-- Use a role with the required privileges +USE ROLE ACCOUNTADMIN; -Now we will switch to the role we just created: +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); -[source,sql] ----- -use role gds_user_role; +USE SCHEMA P2P_DEMO.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE P2P_DEMO; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE P2P_DEMO TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA P2P_DEMO.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE P2P_DEMO TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA P2P_DEMO.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA P2P_DEMO.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; ---- === Cleaning Our Data From 9ccb12dc05b402c86ed8ad030db5ad06c59c65cc Mon Sep 17 00:00:00 2001 From: Corydon Baylor Date: Tue, 10 Feb 2026 19:57:53 -0500 Subject: [PATCH 2/6] insurance --- .../pages/neo4j-insurance-fraud.adoc | 77 +++++++++---------- 1 file changed, 38 insertions(+), 39 deletions(-) diff --git a/modules/snowflake-analytics/pages/neo4j-insurance-fraud.adoc b/modules/snowflake-analytics/pages/neo4j-insurance-fraud.adoc index d5c5083a..33b902bd 100644 --- a/modules/snowflake-analytics/pages/neo4j-insurance-fraud.adoc +++ b/modules/snowflake-analytics/pages/neo4j-insurance-fraud.adoc @@ -89,13 +89,9 @@ roles with specific permissions, so that you can have many people working in the same database without worrying about security. The Neo4j app requires the creation of a few different roles. But before we get started granting different roles, we need to ensure that you are using -`accountadmin` to grant and create roles. Lets do that now: +`accountadmin` to grant and create roles. -.... -USE ROLE ACCOUNTADMIN; -.... - -Next we can set up the necessary roles, permissions, and resource access +We can set up the necessary roles, permissions, and resource access to enable Graph Analytics to operate on the demo data within the `i++_++demo.public` schema (this schema is where the data will be stored by default). @@ -108,44 +104,47 @@ compute pool and warehouse resources required to run the graph algorithms at scale. .... --- Create an account role to manage the GDS application -CREATE ROLE IF NOT EXISTS gds_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_role; - ---Grant permissions for the application to use the database -GRANT USAGE ON DATABASE i_demo TO APPLICATION neo4j_graph_analytics; -GRANT USAGE ON SCHEMA i_demo.public TO APPLICATION neo4j_graph_analytics; - ---Create a database role to manage table and view access -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; - -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA i_demo.public TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA i_demo.public TO DATABASE ROLE gds_db_role; - -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA i_demo.public TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA i_demo.public TO DATABASE ROLE gds_db_role; - -GRANT CREATE TABLE ON SCHEMA i_demo.public TO DATABASE ROLE gds_db_role; - - ---Grant the DB role to the application and admin user -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_role; - -GRANT USAGE ON DATABASE I_DEMO TO ROLE GDS_ROLE; -GRANT USAGE ON SCHEMA I_DEMO.PUBLIC TO ROLE GDS_ROLE; +-- Use a role with the required privileges +USE ROLE ACCOUNTADMIN; -GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA I_DEMO.PUBLIC TO ROLE GDS_ROLE; -GRANT CREATE TABLE ON SCHEMA I_DEMO.PUBLIC TO ROLE GDS_ROLE; -GRANT SELECT, INSERT, UPDATE, DELETE ON FUTURE TABLES IN SCHEMA I_DEMO.PUBLIC TO ROLE GDS_ROLE; +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); + +USE SCHEMA i_demo.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE i_demo; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE i_demo TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA i_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA i_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA i_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA i_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA i_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA i_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE i_demo TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA i_demo.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA i_demo.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; .... -Now we will switch to the role we just created: +Now we will switch to our database: .... -use warehouse NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE; -use role gds_role; use database i_demo; use schema public; .... From c9eb2a29925d9cf50a0fd6068c7477cb8a4d6c92 Mon Sep 17 00:00:00 2001 From: Corydon Baylor Date: Tue, 10 Feb 2026 19:59:27 -0500 Subject: [PATCH 3/6] manufacturing --- .../pages/neo4j-manufacturing.adoc | 91 ++++++++----------- 1 file changed, 39 insertions(+), 52 deletions(-) diff --git a/modules/snowflake-analytics/pages/neo4j-manufacturing.adoc b/modules/snowflake-analytics/pages/neo4j-manufacturing.adoc index a8d3ee57..c91f5fa7 100644 --- a/modules/snowflake-analytics/pages/neo4j-manufacturing.adoc +++ b/modules/snowflake-analytics/pages/neo4j-manufacturing.adoc @@ -179,61 +179,48 @@ now: [source,sql] ---- --- you must be accountadmin to create role and grant permissions -use role accountadmin; ----- - -Next we can set up the necessary roles, permissions, and resource access -to enable Graph Analytics to operate on data within the -`M++_++DEMO.public schema`. It creates a consumer role (gds++_++role) -for users and administrators, grants the Graph Analytics application -access to read from and write to tables and views, and ensures that -future tables are accessible. - -It also provides the application with access to the required compute -pool and warehouse resources needed to run graph algorithms at scale. - -[source,sql] ----- --- Create an account role to manage the GDS application -CREATE ROLE IF NOT EXISTS gds_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_role; - ---Grant permissions for the application to use the database -GRANT USAGE ON DATABASE m_demo TO APPLICATION neo4j_graph_analytics; -GRANT USAGE ON SCHEMA m_demo.public TO APPLICATION neo4j_graph_analytics; - ---Create a database role to manage table and view access -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; - -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA m_demo.public TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA m_demo.public TO DATABASE ROLE gds_db_role; - -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA m_demo.public TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA m_demo.public TO DATABASE ROLE gds_db_role; - -GRANT CREATE TABLE ON SCHEMA m_demo.public TO DATABASE ROLE gds_db_role; - - ---Grant the DB role to the application and admin user -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_role; - -GRANT USAGE ON DATABASE M_DEMO TO ROLE GDS_ROLE; -GRANT USAGE ON SCHEMA M_DEMO.PUBLIC TO ROLE GDS_ROLE; - -GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA M_DEMO.PUBLIC TO ROLE GDS_ROLE; -GRANT CREATE TABLE ON SCHEMA M_DEMO.PUBLIC TO ROLE GDS_ROLE; -GRANT SELECT, INSERT, UPDATE, DELETE ON FUTURE TABLES IN SCHEMA M_DEMO.PUBLIC TO ROLE GDS_ROLE; ----- - -Then we need to switch the role we created: +-- Use a role with the required privileges +USE ROLE ACCOUNTADMIN; + +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); + +USE SCHEMA m_demo.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE m_demo; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE m_demo TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA m_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA m_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA m_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA m_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA m_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA m_demo.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE m_demo TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA m_demo.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA m_demo.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; +---- + +Then we need to switch the database we created: [source,sql] ---- -use warehouse neo4j_graph_analytics_APP_WAREHOUSE; -use role gds_role; use database m_demo; use schema public; ---- From ae05eb78c487b9278cf13e4b65152177dda9f35f Mon Sep 17 00:00:00 2001 From: Corydon Baylor Date: Tue, 10 Feb 2026 20:02:54 -0500 Subject: [PATCH 4/6] patient --- .../pages/neo4j-patient-journey.adoc | 80 +++++++++---------- 1 file changed, 36 insertions(+), 44 deletions(-) diff --git a/modules/snowflake-analytics/pages/neo4j-patient-journey.adoc b/modules/snowflake-analytics/pages/neo4j-patient-journey.adoc index aceb54e1..d58756bb 100644 --- a/modules/snowflake-analytics/pages/neo4j-patient-journey.adoc +++ b/modules/snowflake-analytics/pages/neo4j-patient-journey.adoc @@ -66,16 +66,6 @@ and import the notebook into snowflake. ==== Permissions -Before we run our algorithms, we need to set the proper permissions. But -before we get started granting different roles, we need to ensure that -you are using `accountadmin` to grant and create roles. Lets do that -now: - -[source,sql] ----- -USE ROLE accountadmin; ----- - Next let’s set up the necessary roles, permissions, and resource access to enable Graph Analytics to operate on data within the `NEO4J++_++PATIENT++_++DB.PUBLIC.SCHEMA`. It creates a consumer role @@ -88,40 +78,42 @@ pool and warehouse resources needed to run graph algorithms at scale. [source,sql] ---- --- Create a consumer role for users and admins of the GDS application -CREATE ROLE IF NOT EXISTS gds_user_role; -CREATE ROLE IF NOT EXISTS gds_admin_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_admin_role; - -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role; -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; - --- Grant access to consumer data -GRANT USAGE ON DATABASE NEO4J_PATIENT_DB TO ROLE gds_user_role; -GRANT USAGE ON SCHEMA NEO4J_PATIENT_DB.PUBLIC TO ROLE gds_user_role; - --- Required to read tabular data into a graph -GRANT SELECT ON ALL TABLES IN DATABASE NEO4J_PATIENT_DB TO DATABASE ROLE gds_db_role; - --- Ensure the consumer role has access to created tables/views -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE TABLE ON SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE VIEW ON SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE gds_db_role; - --- Compute and warehouse access -GRANT USAGE ON WAREHOUSE NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE TO APPLICATION neo4j_graph_analytics; ----- - -Then we need to switch the role we created: - -[source,sql] ----- -USE ROLE gds_user_role; +-- Use a role with the required privileges +USE ROLE ACCOUNTADMIN; + +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); + +USE SCHEMA NEO4J_PATIENT_DB.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE NEO4J_PATIENT_DB; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE NEO4J_PATIENT_DB TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA NEO4J_PATIENT_DB.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE NEO4J_PATIENT_DB TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA NEO4J_PATIENT_DB.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA NEO4J_PATIENT_DB.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; ---- === Clean Our Data From 05815edfbe6088255253551dc00c8e4002e231d7 Mon Sep 17 00:00:00 2001 From: Corydon Baylor Date: Tue, 10 Feb 2026 20:04:06 -0500 Subject: [PATCH 5/6] retail --- .../pages/neo4j-retail-recs.adoc | 67 ++++++++++--------- 1 file changed, 35 insertions(+), 32 deletions(-) diff --git a/modules/snowflake-analytics/pages/neo4j-retail-recs.adoc b/modules/snowflake-analytics/pages/neo4j-retail-recs.adoc index 55d2defe..81bdd48c 100644 --- a/modules/snowflake-analytics/pages/neo4j-retail-recs.adoc +++ b/modules/snowflake-analytics/pages/neo4j-retail-recs.adoc @@ -206,39 +206,42 @@ Next, we will grant the necessary permissions for our app to run. Make sure you are account admin before running this block: .... --- Create a consumer role for users and admins of the GDS application -CREATE ROLE IF NOT EXISTS gds_user_role; -CREATE ROLE IF NOT EXISTS gds_admin_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_admin_role; - -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role; -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; - --- Grant access to consumer data -GRANT USAGE ON DATABASE RETAIL_RECS TO ROLE gds_user_role; -GRANT USAGE ON SCHEMA RETAIL_RECS.PUBLIC TO ROLE gds_user_role; - --- Required to read tabular data into a graph -GRANT SELECT ON ALL TABLES IN DATABASE RETAIL_RECS TO DATABASE ROLE gds_db_role; - --- Ensure the consumer role has access to created tables/views -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE TABLE ON SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE VIEW ON SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; - --- Compute and warehouse access -GRANT USAGE ON WAREHOUSE NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE TO APPLICATION neo4j_graph_analytics; -.... - -Then switch to the role we just created: +-- Use a role with the required privileges +USE ROLE ACCOUNTADMIN; -.... -use role gds_role; +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); + +USE SCHEMA retail_recs.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE retail_recs; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE retail_recs TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE retail_recs TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA retail_recs.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA retail_recs.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; .... == Running Node Similiarity From bc18b1c91a99c313786e3fae9604f1b449dc1900 Mon Sep 17 00:00:00 2001 From: Corydon Baylor Date: Tue, 10 Feb 2026 20:05:30 -0500 Subject: [PATCH 6/6] last ones --- .../pages/neo4j-marketing-segmentation.adoc | 69 ++++++++------- .../pages/neo4j-subways.adoc | 83 ++++++++----------- 2 files changed, 70 insertions(+), 82 deletions(-) diff --git a/modules/snowflake-analytics/pages/neo4j-marketing-segmentation.adoc b/modules/snowflake-analytics/pages/neo4j-marketing-segmentation.adoc index 44996d03..c747079b 100644 --- a/modules/snowflake-analytics/pages/neo4j-marketing-segmentation.adoc +++ b/modules/snowflake-analytics/pages/neo4j-marketing-segmentation.adoc @@ -265,43 +265,42 @@ Next we grant the necessary permissions: [source,sql] ---- +-- Use a role with the required privileges USE ROLE ACCOUNTADMIN; ----- -[source,sql] ----- --- Create a consumer role for users and admins of the GDS application -CREATE ROLE IF NOT EXISTS gds_user_role; -CREATE ROLE IF NOT EXISTS gds_admin_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_admin_role; - -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role; -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; - --- Grant access to consumer data -GRANT USAGE ON DATABASE RETAIL_RECS TO ROLE gds_user_role; -GRANT USAGE ON SCHEMA RETAIL_RECS.PUBLIC TO ROLE gds_user_role; - --- Required to read tabular data into a graph -GRANT SELECT ON ALL TABLES IN DATABASE RETAIL_RECS TO DATABASE ROLE gds_db_role; - --- Ensure the consumer role has access to created tables/views -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE TABLE ON SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE VIEW ON SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA RETAIL_RECS.PUBLIC TO DATABASE ROLE gds_db_role; - --- Compute and warehouse access -GRANT USAGE ON WAREHOUSE NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE TO APPLICATION neo4j_graph_analytics; ----- - -[source,sql] ----- -use role gds_role; +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); + +USE SCHEMA retail_recs.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE retail_recs; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE retail_recs TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA retail_recs.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE retail_recs TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA retail_recs.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA retail_recs.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; ---- == Running our Algorithms diff --git a/modules/snowflake-analytics/pages/neo4j-subways.adoc b/modules/snowflake-analytics/pages/neo4j-subways.adoc index 2dee927e..78ed21ee 100644 --- a/modules/snowflake-analytics/pages/neo4j-subways.adoc +++ b/modules/snowflake-analytics/pages/neo4j-subways.adoc @@ -78,53 +78,42 @@ you are using `accountadmin` to grant and create roles. Lets do that now: .... -USE ROLE accountadmin; -.... - -Next let’s set up the necessary roles, permissions, and resource access -to enable Graph Analytics to operate on data within the -`mta.public schema`. It creates a consumer role (gds++_++user++_++role) -for users and administrators, grants the Neo4j Graph Analytics -application access to read from and write to tables and views, and -ensures that future tables are accessible. - -It also provides the application with access to the required compute -pool and warehouse resources needed to run graph algorithms at scale. - -.... --- Create a consumer role for users and admins of the GDS application -CREATE ROLE IF NOT EXISTS gds_user_role; -CREATE ROLE IF NOT EXISTS gds_admin_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_user TO ROLE gds_user_role; -GRANT APPLICATION ROLE neo4j_graph_analytics.app_admin TO ROLE gds_admin_role; - -CREATE DATABASE ROLE IF NOT EXISTS gds_db_role; -GRANT DATABASE ROLE gds_db_role TO ROLE gds_user_role; -GRANT DATABASE ROLE gds_db_role TO APPLICATION neo4j_graph_analytics; - --- Grant access to consumer data -GRANT USAGE ON DATABASE MTA TO ROLE gds_user_role; -GRANT USAGE ON SCHEMA MTA.PUBLIC TO ROLE gds_user_role; - --- Required to read tabular data into a graph -GRANT SELECT ON ALL TABLES IN DATABASE MTA TO DATABASE ROLE gds_db_role; - --- Ensure the consumer role has access to created tables/views -GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE TABLE ON SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT CREATE VIEW ON SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON FUTURE VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role; -GRANT ALL PRIVILEGES ON ALL VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE gds_db_role; - --- Compute and warehouse access -GRANT USAGE ON WAREHOUSE NEO4J_GRAPH_ANALYTICS_APP_WAREHOUSE TO APPLICATION neo4j_graph_analytics; -.... - -Then we need to switch the role we created: - -.... -USE ROLE gds_user_role; +-- Use a role with the required privileges +USE ROLE ACCOUNTADMIN; + +-- Create a consumer role for users of the Graph Analytics application +CREATE ROLE IF NOT EXISTS MY_CONSUMER_ROLE; +GRANT APPLICATION ROLE Neo4j_Graph_Analytics.app_user TO ROLE MY_CONSUMER_ROLE; +SET MY_USER = (SELECT CURRENT_USER()); +GRANT ROLE MY_CONSUMER_ROLE TO USER IDENTIFIER($MY_USER); + +USE SCHEMA MTA.PUBLIC; +CREATE TABLE NODES (nodeId Number); +INSERT INTO NODES VALUES (1), (2), (3), (4), (5), (6); +CREATE TABLE RELATIONSHIPS (sourceNodeId Number, targetNodeId Number); +INSERT INTO RELATIONSHIPS VALUES (1, 2), (2, 3), (4, 5), (5, 6); + +-- Grants needed for the app to read consumer data stored in tables and views, using a database role +USE DATABASE MTA; +CREATE DATABASE ROLE IF NOT EXISTS MY_DB_ROLE; +GRANT USAGE ON DATABASE MTA TO DATABASE ROLE MY_DB_ROLE; +GRANT USAGE ON SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON ALL VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +-- Future tables also include tables that are created by the application itself. +-- This is useful as many use-cases require running algorithms in a sequence and using the output of a prior algorithm as input. +GRANT SELECT ON FUTURE TABLES IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT SELECT ON FUTURE VIEWS IN SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT CREATE TABLE ON SCHEMA MTA.PUBLIC TO DATABASE ROLE MY_DB_ROLE; +GRANT DATABASE ROLE MY_DB_ROLE TO APPLICATION Neo4j_Graph_Analytics; + +-- Ensure the consumer role has access to tables created by the application +GRANT USAGE ON DATABASE MTA TO ROLE MY_CONSUMER_ROLE; +GRANT USAGE ON SCHEMA MTA.PUBLIC TO ROLE MY_CONSUMER_ROLE; +GRANT SELECT ON FUTURE TABLES IN SCHEMA MTA.PUBLIC TO ROLE MY_CONSUMER_ROLE; + +-- Use the consumer role to run the algorithm and inspect the output +USE ROLE MY_CONSUMER_ROLE; .... === Cleaning Our Data