An Administrator needs to provide end users access to data in a Native Object Store using shared credentials. How can this be accomplished?

In Teradata Vantage, the AUTHORIZATION object is the designated mechanism for storing credentials used to access external systems, including Native Object Stores (NOS). To facilitate shared access, an administrator creates a single AUTHORIZATION object containing the required credentials. Subsequently, the administrator grants the USAGE privilege on this specific AUTHORIZATION object to the relevant end-users or roles. When these users query a foreign table that references this AUTHORIZATION object, Teradata Vantage uses the stored, shared credentials to access the data in the object store. This centralizes credential management and provides a secure method for shared access.

A. Define a FOREIGN TABLE with DEFINER TRUSTED security.

A FOREIGN TABLE references an AUTHORIZATION object for credentials. The table definition itself does not store or share the credentials; the AUTHORIZATION object does.

B. Define a FUNCTION MAPPING with INVOKER TRUSTED security.

FUNCTION MAPPING is not the standard object for this purpose. Furthermore, INVOKER security uses the end-user's credentials, which contradicts the requirement for shared credentials.

C. Use an S3 IAM role or Azure SAS token rather than User and Password.

This describes types of credentials that can be stored in an AUTHORIZATION object but does not explain the Teradata mechanism for sharing them among users.

1. Teradata Vantage™ - Native Object Store Getting Started Guide, B035-1214-062K, Chapter 2: Getting Started with Native Object Store, Section: Authorization Objects. The documentation states, "The AUTHORIZATION object stores the credentials that Vantage uses to access the object store... To use an authorization object that you do not own, you must have the USAGE privilege on the object."

2. Teradata Vantage™ SQL Data Definition Language Syntax and Examples, B035-1144-162K, Chapter 4: Data Definition Statements, Section: CREATE AUTHORIZATION. This section details the syntax for creating the object that holds credentials for external servers.

3. Teradata Vantage™ SQL Data Control Language, B035-1149-162K, Chapter 2: Grant and Revoke, Section: GRANT (Object Privilege Form). This document specifies that the USAGE ON AUTHORIZATION privilege allows a user to use the specified authorization object to access external data. This is the mechanism for sharing.