更改索引而不是表的权限

Question

In SQL Server, is there a combination of permissions that will allow some user to run ALTER INDEX statements but not DROP INDEX/TABLE/etc statements? From what I've read, it looks like granting ALTER gives all the ALTER/DROP/TRUNCATE permissions, and indexes aren't a securable so I can't limit the acceptable statements to just ALTER/DROP indexes (this would be suboptimal, but would be better than just letting the user drop anything).

Answer 1

Thanks to the recommendation in the comments from Ben, I was able to achieve this through signed stored procedure functionality. I basically followed the instructions here , but in case that's gone in the future, these were the steps to get there (including some of the code from the linked tutorial):

1. Create Cert

   CREATE CERTIFICATE TestCreditRatingCer
   ENCRYPTION BY PASSWORD = 'pGFD4bb925DGvbd2439587y'
   WITH SUBJECT = 'Credit Rating Records Access',
   EXPIRY_DATE = '12/31/2021'; -- Error 3701 will occur if this date is not in the future

   GO

2. Create Stored Procedure to do the narrow task (alter indexes in this case) and sign using the cert from step 1

   ADD SIGNATURE TO TestCreditRatingSP
   BY CERTIFICATE TestCreditRatingCer
   WITH PASSWORD = 'pGFD4bb925DGvbd2439587y';
   GO

3. Create login for running the stored procedure using the cert above and the new users for the applicable databases

   CREATE USER TestCreditRatingcertificateAccount
   FROM CERTIFICATE TestCreditRatingCer;
   GO

4. Grant ALTER rights on the appropriate objects to the new certificate user and EXEC on the new stored proc to the user(s) you want to be able to run the ALTER statements.