POST_START

Building Read-Only Production Access for Analysts

I was recently tasked with setting up read-only access to a production catalog for a group of analysts. The goal was to ensure they could query the data they needed without being able to modify anything. I knew that using Databricks Unity Catalog would be the right approach, as it provides fine-grained access control and helps maintain data integrity.

Granting Access to the Production Catalog

I started by granting the `production-analysts` group the ability to use the `production` catalog. This step is crucial because it allows the analysts to see and interact with the catalog, but it doesn’t give them any permissions to modify data.

GRANT USE CATALOG ON CATALOG production TO `production-analysts`;

I saw a representative result like this:

result
Grant applied successfully; the principal now has the requested privilege.

This confirmed that the permission was granted successfully. Now the analysts can access the catalog, but they can’t do anything with it yet.

Granting Access to Specific Schemas

Next, I wanted to grant access to the `reporting` schema within the `production` catalog. This schema contains several tables that the analysts need to query for their reports. I made sure to grant them the `USE SCHEMA` privilege, which allows them to view and query the objects within the schema without being able to alter it.

GRANT USE SCHEMA ON SCHEMA production.reporting TO `production-analysts`;

I saw a representative result like this:

result
Grant applied successfully; the principal now has the requested privilege.

With this permission, the analysts could now navigate to the `reporting` schema and start querying the tables. But they still couldn’t access the actual data until I granted them the necessary table-level permissions.

Granting Select Access to a Specific Table

To make sure the analysts could run their reports, I needed to grant them `SELECT` access to the `daily_sales` table in the `reporting` schema. This table is central to their analysis, and I wanted to ensure they had read-only access to it without any ability to write or alter data.

GRANT SELECT ON TABLE production.reporting.daily_sales TO `production-analysts`;

I saw a representative result like this:

result
Grant applied successfully; the principal now has the requested privilege.

After running this command, I verified that the analysts could now query the `daily_sales` table successfully. They were able to retrieve the data they needed without being able to modify it, which met the requirements for read-only access.

Conclusion

By following these steps, I was able to create a secure and controlled environment for the analysts to work with the production data. Each grant was carefully chosen to ensure that they had the minimum necessary permissions to perform their tasks, while maintaining the integrity and security of the data.