With 2008 - What would be the 'best practice' approach for giving a principal access to system views

Question

I want to setup a job that runs a few select statements from several system management views such as those listed below.  Its basically going to gather various metrics about the server, a few different databases and jobs.
msdb.dbo.sysjobs
msdb.dbo.sysjobhistory
sys.dm_db_missing_index_groups
sys.dm_db_missing_index_group_stats
sys.dm_db_missing_index_details
sys.databases
sys.dm_exec_query_stats
sys.dm_exec_sql_text
sys.dm_exec_query_plan
dbo.sysfiles
sys.indexes
sys.objects
So, there a number of instance-level permissions that are needed, mainly VIEW SERVER STATE
https://msdn.microsoft.com/en-us/library/ms186717.aspx
Granting these permissions to a single login seems like introducing a maintenance headache for later.  What about a server role?
Correct me if Im wrong, but this is a new feature of 2012 and above, the ability to create user-defined server roles.
Prior to version 2012, I will just have to settle for granting these instance-level permissions to individual logins.  There wont be many logins that need this kind of permissions, but id rather assign them at a role level then add logins to that role.
 Then again, there is little point in creating a seperate role if there is only 1...and maybe 2 logins that might need this role?
New for 2012
http://www.mssqltips.com/sqlservertip/2699/sql-server-user-defined-server-roles/

Answer 1

Just as any Active Directory Administrator will tell you you should indeed stick to the rule - "user in role- permissions to role" - in AD terms "A-G/DL-P. And since this is very much possible since SQL Server 2012 why not just do that. You
lose nothing if you don't ever change that one single user. In the end you would only expect roles to have permissions and save some time when searching for permission problems.
i.e.
USE [master]
GO
CREATE SERVER ROLE [role_ServerMonitorUsers]
GO
GRANT VIEW SERVER STATE TO [role_ServerMonitorUsers]
GO
ALTER SERVER ROLE [role_ServerMonitorUsers]
ADD MEMBER [Bob]
GO
In security standardization is just as much key as in administration in general. So even if it does not really matter, it may matter in the long run. :)
Andreas Wolter (Blog |
Twitter)
MCSM: Microsoft Certified Solutions Master Data Platform, MCM, MVP
www.SarpedonQualityLab.com |
www.SQL-Server-Master-Class.com