POST_START

Controlling Who Can Create Governed Views in Production Unity Catalog Schemas

I recently had the responsibility of ensuring that only specific team members could create governed views in our production Unity Catalog schemas. The goal was to maintain data governance and prevent unauthorized access or modifications to sensitive data. I started by understanding the existing permissions and how they aligned with our security policies.

Understanding the Scope of Permissions

I first checked the current permissions on the production catalog and schema to get a clear picture of what was allowed. I ran the SHOW GRANTS ON SCHEMA production.reporting; command to see who had access to the schema and what actions they could perform.

SHOW GRANTS ON SCHEMA production.reporting;

I noticed that the reporting_engineers group didn’t have the ability to create views, which was a key requirement for our governance strategy. I realized that to allow them to create views, I needed to grant the appropriate permissions step by step.

Granting Access to the Catalog

Before granting access to the schema, I needed to ensure that the reporting_engineers group could access the production catalog itself. I ran the following command:

GRANT USE CATALOG ON CATALOG production TO `reporting_engineers`;

This step was important because without access to the catalog, the group wouldn’t be able to interact with any schemas or tables within it. I verified that the grant was successful by checking the catalog-level permissions again, which confirmed that the group now had access.

Granting Access to the Schema

Next, I granted the reporting_engineers group access to the production.reporting schema. I executed the following command:

GRANT USE SCHEMA ON SCHEMA production.reporting TO `reporting_engineers`;

This allowed the group to view and interact with objects within the schema, but not to create new views. I wanted to make sure that they could only create views under strict governance, so I needed to grant the CREATE VIEW permission specifically.

Granting the Ability to Create Views

Finally, I granted the reporting_engineers group the ability to create views in the production.reporting schema. I ran the following command:

GRANT CREATE VIEW ON SCHEMA production.reporting TO `reporting_engineers`;

This step was crucial because it allowed the group to create views without giving them full schema access. I wanted to ensure that they could only create views and not modify existing tables or schemas, which would violate our governance policies.

Verifying the Permissions

After granting all the necessary permissions, I ran the SHOW GRANTS ON SCHEMA production.reporting; command again to verify that the reporting_engineers group had the correct access level. The output confirmed that they had the USE SCHEMA and CREATE VIEW permissions, but not full schema access.

This approach ensured that only authorized users could create governed views in the production schema, maintaining data integrity and compliance. I felt confident that our data governance policies were now more secure and aligned with our operational needs.