POST_START
Granting and Revoking Catalog-Level Access
I recently had the task of managing access to a Databricks Unity Catalog called training. My team needed to ensure that only specific roles could interact with this catalog, while others had no access. I decided to use the GRANT and REVOKE commands to manage these permissions at the catalog level.
Granting Access to the Training Catalog
I started by identifying the role that should have access to the training catalog. The role was named analysts, and they needed the USE CATALOG privilege to work with the data in this catalog.
GRANT USE CATALOG ON CATALOG training TO `analysts`;
Grant applied successfully; the principal now has the requested privilege.
I noticed that the system confirmed the privilege was applied successfully. This meant that the analysts role could now access the training catalog.
Verifying the Grants on the Training Catalog
To make sure the access was granted correctly, I ran the SHOW GRANTS command on the training catalog. This allowed me to see all the grants that had been applied to it.
SHOW GRANTS ON CATALOG training;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE CATALOG | CATALOG |
| data_engineers | CREATE SCHEMA | CATALOG |
I verified that the analysts role had the USE CATALOG privilege, and I also saw that data_engineers had the CREATE SCHEMA privilege. This confirmed that the access controls were working as intended.
Revoking Access from the Training Catalog
Later, I needed to revoke the USE CATALOG privilege from the analysts role because their access was no longer required. I ran the REVOKE command to remove the privilege.
REVOKE USE CATALOG ON CATALOG training FROM `analysts`;
Revoke applied successfully; the requested privilege is no longer granted.
I checked the system response and saw that the privilege had been successfully revoked. This meant that the analysts role could no longer access the training catalog, which aligned with our security policies.
Throughout this process, I learned how to manage access at the catalog level using Unity Catalog. It was a straightforward yet important task that ensured data security and compliance within our organization.
Leave a Reply