Unlimited quota vs unlimited tablespace for the Protect and Update Readiness Oracle users, which is best?

Products

• Data Loss Prevention Enforce

Issue/Introduction

We have a request from database security team, that they would revoke the high privileges "UNLIMITED TABLESPACE" from the Protect and Update readiness Oracle users and replace it with "Unlimited Quota".

Is there any risk in doing so?

 

Environment

Release :

Component :

Resolution

The DLP Protect user does require the ability to extend the tablespace as needed. In particular the USERS and LOB_TABLESPACE will require the most space, see KB The difference between USERS and LOB_TABLESPACE tablespaces

I believe if you set a quota then automatic extend will not be allowed and therefore you will run into trouble when the tablespace has exceeded it's current size.

For example here's one page I found on the topic which discusses this problem: BE CAREFUL WHEN REVOKING UNLIMITED TABLESPACE.

In either case your DBA will need to be responsible for such change if it happens and take the necessary action to remediate any issues that may occur if there is a problem later on. 

With regards to the Update readiness User account the privileges are required only while running the Update Readiness Tool so you can if needed revoked after the upgrade and migration has been completed, until the next upgrade requires the account again.