docs - upload privileges (#37091)

docs/databases/uploads.md

@@ -29,7 +29,7 @@ You can also upload data to the Sample Database included with Metabase (an H2 da
 For more, check out:
 
 - [Adding and managing databases](./connecting.md)
-- [Database users, roles, and privileges](./users-roles-privileges.md)
+- [Database users, roles, and privileges](./users-roles-privileges.md#privileges-to-enable-uploads)
 
 ### Select the database and schema that you want to store the data in
 
@@ -87,7 +87,7 @@ Represents the year, month, day, hour. Minutes, seconds, and fractional seconds
 
 **Format**: `yyyy-MM-ddTHH:mm:ss.SSS`. The "T" separator could also be a space (" ").
 
-**Examples**: 
+**Examples**:
 
 - `2023-01-01 00`
 - `2023-01-01 00:00:00.000`
@@ -98,12 +98,12 @@ Represents the year, month, day, hour. Minutes, seconds, and fractional seconds
 
 Represents the datetime with an offset from Coordinated Universal Time (UTC). Minutes and seconds in the offset are optional.
 
-**Formats**: 
+**Formats**:
 
 Datetime formats:
 
-- `yyyy-MM-ddTHH:mm`. 
-- `yyyy-MM-ddTHH:mm:ss`. 
+- `yyyy-MM-ddTHH:mm`.
+- `yyyy-MM-ddTHH:mm:ss`.
 - `yyyy-MM-ddTHH:mm:ss.SSS` (and any number of S's).
 
 The "T" separator could also be a space (" ").
@@ -111,9 +111,9 @@ The "T" separator could also be a space (" ").
 Offsets:
 
 - `Z` (for UTC)
-- `+HH` or `-HH` 
-- `+HH:mm` or `-HH:mm` 
-- `+HH:mm:ss` or `-HH:mm:ss` 
+- `+HH` or `-HH`
+- `+HH:mm` or `-HH:mm`
+- `+HH:mm:ss` or `-HH:mm:ss`
 
 **Examples**:
 

docs/databases/users-roles-privileges.md

@@ -134,6 +134,30 @@ GRANT INSERT, UPDATE, DELETE ON "your_model's_table" IN SCHEMA "your_schema" TO
 GRANT metabase_model_caching TO metabase;
 ```
 
+## Privileges to enable uploads
+
+You can [upload CSVs](../databases/uploads.md) to supported databases. Metabase's database user should have write access (`INSERT`, `UPDATE`, `DELETE`) to the schema where you want to store the uploads.
+
+You'll first need to create a schema to store uploads (or use an existing schema) and tell Metabase that you want to [use that schema to store uploads](./uploads.md#select-the-database-and-schema-that-you-want-to-store-the-data-in).
+
+In addition to the [minimum database privileges](#minimum-database-privileges):
+
+- Create a new role called `metabase_uploads`.
+- Give the role `INSERT`, `UPDATE`, and `DELETE` privileges to the schema where you want to store uploads.
+- Give the `metabase_uploads` role to the `metabase` user.
+
+```sql
+-- Create a role to bundle database privileges for uploads.
+CREATE ROLE metabase_uploads WITH LOGIN;
+
+-- Grant write privileges to the SCHEMA used for uploads.
+GRANT USAGE ON "your_schema" TO metabase_uploads;
+GRANT INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA "your_schema" TO metabase_uploads;
+
+-- Grant role to the metabase user.
+GRANT metabase_uploads TO metabase;
+```
+
 ## Multi-tenant permissions
 
 If you're setting up multi-tenant permissions for customers who need SQL access, you can [create one database connection per customer](https://www.metabase.com/learn/permissions/multi-tenant-permissions#granting-customers-native-sql-access-to-their-schema). That means each customer will connect to the database using their own database user.