CreateTableMustHaveOneGrant

CreateTableMustHaveOneGrant is a custom policy check that requires every CREATE TABLE statement to also have at least one GRANT included.

regex: (?is)(?=.*\b(create\s+table)\b)(?!.*\b(grant)\b).*

This example utilizes Oracle. You can use this check as it is or customize it further to fit your needs in your SQL database. All Regex Custom Policy Checks can only run against the changelog, not against the database.

Liquibase Prerequisites

• Install Liquibase 4.29.0+
• Configure a valid Liquibase Pro license key
• Ensure the Liquibase Checks extension is installed. In Liquibase 4.31.0+, it is already installed in the /liquibase/internal/lib directory, so no action is needed. If the checks JAR is not installed, download liquibase-checks-<version>.jar and put it in the liquibase/lib directory.
  • Maven users only: Add this dependency to your pom.xml file:

<dependency>
    <groupId>org.liquibase.ext</groupId>
    <artifactId>liquibase-checks</artifactId>
    <version>2.0.0</version>
</dependency>

• Java Development Kit 17+ (available for Open JDK and Oracle JDK)
• Linux, macOS, or Windows operating system
• Familiarity with Liquibase concepts: Changelog, Changeset, Policy Checks Commands, checks-scope, and snapshot

Python prerequisites

Before creating a custom policy check with Python, we recommend being familiar with:

• Python 3.10.14+. (See here for the official Python tutorial)
• Optional: General coding and Python best practices which will improve your check performance:
• Efficient handling of structured data objects
• Effective and targeted parsing of text, objects, and SQL
• Using regular expressions and other pattern-matching tools within Python
• Using Python virtual environments. Liquibase comes with a built-in virtual environment for Liquibase Custom Policy Checks. The built-in environment includes Liquibase Python modules and some common external Python modules—no configuration needed. However, if you want to install additional modules, or if you want your IDE to recognize the Liquibase modules, you must Create a Python Virtual Environment separately.

Tip: Downloading Python itself is not required to create custom checks in the Liquibase checks framework, but it may be useful to test checks against Python 3.10.14+.

Step-by-Step

Note: These steps describe how to create the custom policy check. It does not exist by default in Liquibase Pro.

1. Enter this command into the CLI: 
   liquibase checks customize --check-name=SqlUserDefinedPatternCheck
2. Give your check a short name for easier identification. In this example we will title the check:
   CreateTableMustHaveOneGrant

3. Set the Severity to return a code of 0-4 when triggered.
   Options: 'INFO'=0, 'MINOR'=1, 'MAJOR'=2, 'CRITICAL'=3, 'BLOCKER'=4

4. Set the SEARCH_STRING to this valid regular expression:
   (?is)(?=.*\b(create\s+table)\b)(?!.*\b(grant)\b).*

5. Set the MESSAGE for when a match for regular expression <SEARCH_STRING> is found in a Changeset:
   

   Example: Error! CREATE TABLE statement found but there was no GRANT found. Every CREATE TABLE must have at least one GRANT statement.

6. Set STRIP_COMMENTS to true if you want to remove the comments from the output.
   

7. Leave the PATH_Filter_REGEX blank.

8. Set 'SPLIT_STATEMENTS' to false so Liquibase does not split multiple SQL statements on the delimiter or evaluate each individually.
   The regex custom policy check is created successfully.

Sample Passing Script

--changeset amalik:employee
CREATE TABLE EMPLOYEE (
   EMPLOYEE_ID INT NOT NULL GENERATED ALWAYS AS IDENTITY    CONSTRAINT PEOPLE_PK PRIMARY KEY, 
   FIRST_NAME VARCHAR(26),
   LAST_NAME VARCHAR(26)
);
GRANT select ON EMPLOYEE to APPUSER;

Sample Failing Scripts

--changeset amalik:employee
CREATE TABLE EMPLOYEE (
   EMPLOYEE_ID INT NOT NULL GENERATED ALWAYS AS IDENTITY    CONSTRAINT PEOPLE_PK, 
   FIRST_NAME VARCHAR(26),
   LAST_NAME VARCHAR(26)
);

Sample Error Message

CHANGELOG CHECKS
----------------
Checks completed validation of the changelog and found the following issues:

Check Name:         Check for specific patterns in sql (CreateTableMustHaveOneGrant)
Changeset ID:       EMPLOYEE
Changeset Filepath: script1.sql
Check Severity:     MAJOR (Return code: 2)
Message:            Error! CREATE TABLE statement found but there was no GRANT found. Every CREATE TABLE must have at least one GRANT statement.