POST_START

Creating and Inspecting Governed External Locations

I recently needed to set up a new external location in Unity Catalog to access raw data stored in cloud storage. This location would be used by multiple teams, so I wanted to ensure it was properly governed and secured. I started by creating the external location with the correct storage credential.

CREATE EXTERNAL LOCATION raw_data URL 's3://company-raw-data/raw' WITH (STORAGE CREDENTIAL my_storage_credential);

I noticed that the command executed without any errors, which was a good sign. Next, I wanted to verify that the external location had been created successfully and check its details.

SHOW EXTERNAL LOCATIONS;

<

name	url	credential_name
raw_data	s3://company-raw-data/raw	my_storage_credential

Looking at the output, I confirmed that the external location named raw_data was listed with the correct URL and storage credential. This helped me ensure that the location was properly defined in Unity Catalog.

To get more detailed information about the external location, I ran the DESCRIBE EXTERNAL LOCATION command. This helped me understand the ownership and governance settings for the location.

DESCRIBE EXTERNAL LOCATION raw_data;

name	url	credential_name	owner
raw_data	s3://company-raw-data/raw	my_storage_credential	data_platform_admins

The output showed that the owner of the external location was data_platform_admins, which aligned with our governance policy. This meant that the team responsible for managing the data platform had control over this location.

Finally, I wanted to check the access rights assigned to the external location to ensure that only authorized users and groups could use it. I ran the SHOW GRANTS command to review the permissions.

SHOW GRANTS ON EXTERNAL LOCATION raw_data;

principal	actionType	objectType
data_analysts	USE CATALOG	EXTERNAL LOCATION
data_engineers	USE CATALOG	EXTERNAL LOCATION

The output listed the groups that had access to the external location. I saw that data_analysts and data_engineers were granted the USE CATALOG action, which allowed them to access the data stored in this location. This confirmed that the access control was set up correctly according to our team’s requirements.

Throughout this process, I learned how to create, inspect, and govern external locations in Unity Catalog. These steps are essential for ensuring that data is accessed securely and in compliance with organizational policies.