Abstract: A restricted view definition is received by a database system. The restricted view definition defines a view over a database table with one or more restrictions on use of the view. The view over the database table is generated based on the restricted view definition. A query directed at the view is received by the database system. The database system determines whether the query directed at the view is permitted based on the one or more restrictions on the use of the view.

Abstract: Disclosed are techniques for deduplicating files to be ingested by a database. A bloom filter may be built for each of a first set of files to be ingested into a data exchange to generate a set of bloom filters, wherein the data exchange includes a metadata storage where metadata including a list of files ingested is stored. The set of bloom filters may be stored in the metadata storage of the data exchange. In response to receiving a set of candidate files to be ingested into the data exchange, the set of bloom filters may be used to identify from within the set of candidate files, each candidate file that is duplicative of a file in the first set of files.

Abstract: A network device communication system can configure network devices, such as a first database in a multi-tenant deployment and a second database in a private deployment, to send and receive sequence messages, such as replication data, over a channel comprising a plurality of private network nodes. The first database can create a link specifying the data share and the second database. The second database selects the link and a secure area in the private deployment is created into which data is replicated and shared with further accounts in a computationally secure and efficient manner.

Abstract: In an embodiment, a database platform receives a query that is directed at least in part to external data in an external table stored on a data storage platform that is external to the database platform. The external table includes a plurality of partitions. The database platform identifies, from external-table metadata, a subset of the plurality of partitions of the external table as including data that potentially satisfies the query. The external-table metadata is stored by the database platform. The database platform identifies data that satisfies the query by scanning the identified subset of the partitions, and responds to the query at least in part with the identified data that satisfies the query.

Abstract: A method of implementing sub-table replication starts with the processor detecting an update to an entitlements table. The processor performs filtering of a data table based on the update to the entitlements table. The data table including an entitlements column. The processor detects an update to the entitlements column and performs incremental replication of the data table by causing a version-based replication to be executed. Other embodiments are also described herein.

Abstract: Systems and methods for managing membership in a private data exchange are provided herein. In one embodiment, the method includes generating a plurality of listings in a data exchange, each of the plurality of listings comprising version metadata and referencing a data set within a database. The method further includes receiving a request for access to a first listing of the plurality of listings and, in response to the request, accessing a first version of the data set that is compatible with first version metadata of the first listing.

Abstract: Techniques described herein can optimize usage of computing resources in a data system. Dynamic throttling can be performed locally on a computing resource in the foreground and autoscaling can be performed in a centralized fashion in the background. Dynamic throttling can lower the load without overshooting while minimizing oscillation and reducing the throttle quickly. Autoscaling may involve scaling in or out the number of computing resources in a cluster as well as scaling up or down the type of computing resources to handle different types of situations.

Abstract: Using container-centric managed access, an administrator is enabled to define a set of future grants for each object that will be created in the future in a container managed by the administrator. When a user creates a database object, the system checks the future grants to determine if any apply to the user, the database object, or the combination. Any applicable future grants are applied to the database object before the user is allowed to modify it. As a result, the administrator is enabled to control the privileges associated with the database object even before the database object is created, while restricting individual object owners from managing privileges on their owned objects.

Abstract: A system for generating similarity data for different datasets in a cloud data platform. A first dataset of a plurality of datasets on the cloud data platform is identified, where the first dataset is associated with a first user of the cloud data platform. A semantic type for each feature the first dataset is identified, and each semantic type for the first dataset is compared with existing data of the first user. Semantic types for each feature of each dataset are identified, and each semantic type for the first dataset is compared to each semantic type of each dataset. Overlap requests are generated to output overlap datasets between the first dataset and each of the plurality of datasets. A results dataset is generated by applying the overlap requests to a joined dataset comprising data from the first dataset and data from each of the plurality of datasets.

Abstract: Embodiments of the present disclosure may provide a streamlined process for performing operations, such as data sharing and data replication, using multiple accounts. A global identity (also referred to as an organization user) may be employed, where the global identity may have access to multiple accounts across the same or different deployments. The global identity may switch between accounts from its login session and perform various tasks in the context of different accounts without undergoing further authentication.

Abstract: Providing access to consumer information on a private data exchange is described. In an example, privileges are assigned to a share object, granting access to consumer information obtained from a query against data referenced by a data listing of a data exchange. The data exchange comprises one or more data listings provided by one or more data providers. In response to the share object being added to a list of consumed share objects of a data provider that provided the data listing, a database is generated that references the consumer information based on the share object. Access to the database is granted to the data provider that provided the data listing.

Abstract: A method, system, and apparatus for managing a persistent query result set are disclosed. A resource manager is disclosed that receives a query from a client over a computer network. A computer database server is disclosed that executes the query and generates a result set based on and in response to the received query. An execution platform is disclosed that divides the result set into a plurality of chunks, wherein each chunk comprises a portion of the generated result set. The resource manager adds metadata to each of the plurality of chunks. A first chunk of the plurality of chunks comprises metadata pointing to the plurality of chunks. The resource manager delivers at least the first chunk of the plurality of chunks to the client in response to the query. The execution platform offloads the remaining plurality of chunks to cloud storage in parallel.

Abstract: Provided herein are systems and methods to provide a way to share metrics regarding shared data access and accesses associated with data providers for different data listings of the data exchange. For example, the method may comprise detecting one or more client interactions with a set of data listings of a data exchange, the set of data listings associated with one or data providers. The method may further comprise collecting metrics corresponding to the one or more client interactions. In addition, the method may share metrics relevant to the one or more data providers with the one or more data providers.

Abstract: Embodiments of the present disclosure relate to sharing database roles using hidden roles. A database role may be generated within a database container having a plurality of data objects, wherein the database role exists exclusively within the database container. A set of grants to a particular subset of the plurality of data objects of the database container may be assigned to the database role and the database role may be granted to the share object. The share object is mounted within a consumer account to generate an imported database container within the consumer account, the imported database container including an imported copy of the database role. The imported copy of the database role may be granted to each of one or more account level roles of the consumer account to share the particular subset of the plurality of data objects without creating proxy objects in the consumer account that represent the particular subset of the plurality of data objects.

Abstract: A method for tracing function execution includes instantiating, by at least one hardware processor of a computing node, a user code runtime configured with access to an operating system (OS) kernel of the computing node. The user code runtime is configured with a first set of filtering policies associated with a first set of allowed system calls. The OS kernel is configured with a second set of filtering policies associated with a second set of allowed system calls. A system call initiated by the user code runtime is detected to violate one or both of the first set of allowed system calls and the second set of allowed system calls. A trace of the system call is initiated based on the detecting.

Abstract: The disclosure relates generally to methods, systems, and apparatuses for managing network connections. An example method includes receiving one or more messages from a plurality of computing devices connected through a network, the one or more messages indicating actual connections among the plurality of computing devices. The example method further includes comparing, by one or more processors, the actual connections to a list of expected connections indicated by a connections master file that comprises connection information for the plurality of computing devices. The method further includes, responsive to detecting one or more differences between the list of expected connections and the actual connections, providing a notification indicating the one or more differences to a log file or a notification area of a user interface.

Abstract: First and second database accounts respectively share first and second source datasets with one another in a data clean room. The first database account stores a first approved-statements table that contains database statements that are permitted by the first database account to be executed against a combination of the shared first source dataset and the shared second source dataset. The second database account stores a second approved-statements table that contains database statements that are permitted by the second database account to be executed against the combination of the shared first source dataset and the shared second source dataset. One or more queries received from the first database account that are included in the second approved-statements table are processed, as are one or more queries received from the second database account that are included in the first approved-statements table.

Abstract: Embodiments of the present disclosure describe systems, methods, and computer program products for improving query processing of a database. An example method can include: storing table data for a table in a plurality of micro-partitions, each micro-partition comprising a portion of the table data for the table; for each micro-partition of the plurality of micro-partitions, storing metadata for the micro-partition in at least one of a plurality of expression properties; and selecting, by a processing device, a subset of the plurality of expression properties to be grouped into a grouping expression property based at least partially on the metadata of the subset of the plurality of the expression properties. The grouping expression property may include cumulative metadata associated with the metadata of the subset of the plurality of expression properties.

Abstract: Techniques described herein can allow users to share cached results of an original query with other users while protecting sensitive information. The techniques described herein can check whether the other users have access to the underlying data queried before allowing those users to see the stored query results. That is, the system may perform privilege checks on the shared users before giving them access to the stored query results but without having to re-run the original query.

Abstract: A pruning index is generated for a source table organized into a set of batch units. The source table comprises a column of semi-structured data. The pruning index comprises a set of filters that index distinct values in each column of the source table. Rather than reassembling an entire tree structure of the semi-structured data prior to indexing, the generating of the pruning index comprises traversing a reassembly hook object that represents a first portion of the semi-structured data that is subcolumnarized and traversing a residual object that represents a second portion of the semi-structured data that is not subcolumnarized. The reassembly hook object is traversed to identify values corresponding to the first portion of the semi-structured data and the residual object is traversed to identify values corresponding to the second portion. The pruning index is stored with an association with the source table.