POST_START

Designing Least-Privilege Unity Catalog Read Access for Production Analytics Users

I started my day by reviewing the access requirements for the production analytics users. We needed to ensure that these users could read data from specific tables in the production catalog, but with the principle of least privilege in mind—granting only the permissions they truly needed.

Granting Use on the Catalog

I first decided to grant the USE CATALOG permission on the production catalog to the analysts role. This would allow the analysts to access the catalog without needing more permissions than necessary.

GRANT USE CATALOG ON CATALOG production TO `analysts`;

I ran this command in the Databricks notebook. The response confirmed that the permission was successfully granted. I noticed that this step was crucial because it allowed the analysts to navigate the catalog structure without accessing any specific schemas or tables.

Granting Use on the Schema

Next, I wanted to grant the USE SCHEMA permission on the production.reporting schema to the analysts role. This would let them explore the schema and access its objects without needing to have table-level permissions upfront.

GRANT USE SCHEMA ON SCHEMA production.reporting TO `analysts`;

I executed this command and verified that the analysts could now see the objects in the reporting schema. This step was important for ensuring they could find the data they needed without unnecessary restrictions.

Granting Select on the Table

Finally, I granted the SELECT permission on the production.reporting.daily_sales table to the analysts role. This would allow them to query the data they needed for their reports and analyses.

GRANT SELECT ON TABLE production.reporting.daily_sales TO `analysts`;

I ran the command and checked the response to confirm the permission was applied. I verified that the analysts could now query the daily_sales table, which was exactly what they needed for their work.

Verifying the Grants

To make sure the permissions were correctly applied, I ran the SHOW GRANTS command on the production.reporting.daily_sales table. This helped me confirm the exact permissions that had been granted to the analysts role.

SHOW GRANTS ON TABLE production.reporting.daily_sales;

The output showed that the analysts role had the SELECT permission, which aligned with our design. I noticed that this step was essential for auditing and ensuring that the permissions were applied as intended.

Throughout the process, I reflected on how each step contributed to maintaining a secure and efficient data access model. By following the principle of least privilege, we ensured that the analysts had exactly the access they needed without unnecessary exposure to other parts of the catalog.