Databricks Unity Catalog Tutorial: Restrict a Production Catalog to Approved Workspaces

This tutorial focuses on implementing workspace access restrictions within a production Unity Catalog. We’ll guide you through creating a setup where a production catalog is exclusively accessible by a limited set of approved workspaces.

Scenario: Implementing Workspace Access Control

Imagine you’re managing a data warehouse built on Unity Catalog. You need to control which workspaces can access your production data. This script demonstrates how to achieve this using Databricks SQL and Unity Catalog’s workspace access control features.

Script 1: Creating the Production Catalog and Initial Workspaces

First, we’ll create a production catalog and two workspaces for testing. These workspaces will be our ‘approved’ workspaces.

CREATE CATALOG IF NOT EXISTS production_catalog
  AS REPLICA (
    SELECT 
    FROM CATALOG default
    WHERE catalog_name = 'production_catalog'
  );

CREATE WORKSPACE IF NOT EXISTS workspace_a
  IN production_catalog;

CREATE WORKSPACE IF NOT EXISTS workspace_b
  IN production_catalog;

This code initializes the environment. The `CREATE CATALOG` statement creates the `production_catalog`. The `CREATE WORKSPACE` statements create two workspaces, `workspace_a` and `workspace_b`, within that catalog. Note the use of `IF NOT EXISTS` to prevent errors if the objects already exist.

Script 2: Granting Workspace Access to the Production Catalog

Now, we’ll grant access to the production catalog to the approved workspaces. We’ll use the `GRANT ACCESS` command.

GRANT ACCESS ON CATALOG production_catalog TO WORKSPACE workspace_a;
GRANT ACCESS ON CATALOG production_catalog TO WORKSPACE workspace_b;

This code explicitly grants access to the `production_catalog` to `workspace_a` and `workspace_b`. This is the core of the access restriction. The `GRANT ACCESS` command specifies the target catalog and the target workspace.

Script 3: Demonstrating the Access Restriction

Finally, we will attempt to access the catalog from a disallowed workspace to prove the restriction is working. This also serves as the validation step.

-- Attempt to access the production catalog from a disallowed workspace
USE CATALOG default; -- Using default to demonstrate access denial
SELECT 
FROM production_catalog.default.mytable;

This script attempts to use the default catalog, which does not have access granted to any workspace, to query the `production_catalog`. The `USE CATALOG default;` command switches the current session to the default catalog. The `SELECT` statement tries to query a table in the `production_catalog`. The query will fail due to the access restrictions defined in Script 2. The user attempting this query will receive an access denied error.

Validation Query

SELECT COUNT()
FROM production_catalog.default.access_granted_count;

0