POST_START

Granting Read Access to a Governed Production External Location

I recently had the task of granting read access to a governed production external location in Databricks Unity Catalog. The location, named production_raw, is used by data engineers to access raw data stored in an S3 bucket. My goal was to ensure that the data_engineers group could read files from this location while maintaining governance and security.

Understanding the External Location

I started by describing the production_raw external location to understand its configuration and ownership. This step is crucial because it helps verify that the location exists and provides details like the URL, credential, and owner, which are necessary for proper access management.

DESCRIBE EXTERNAL LOCATION production_raw;

name	url	credential_name	owner
production_raw	s3://company-prod/raw	production_storage	data_platform_admins

I noticed that the location is owned by the data_platform_admins group, which aligns with the governance policy in place. The URL points to an S3 bucket, and the credential is named production_storage, which I had previously configured for secure access.

Granting Read Access

Next, I needed to grant the READ FILES privilege on the production_raw external location to the data_engineers group. This is a standard operation in Unity Catalog for granting controlled access to external data sources while ensuring that only authorized users can interact with the data.

GRANT READ FILES ON EXTERNAL LOCATION production_raw TO `data_engineers`;

I verified that the grant was applied successfully. This means that the data_engineers group can now read files from the production_raw location. I made sure to use the exact syntax and fully qualified identifier for the group, as required by Unity Catalog.

Verifying the Grant

To confirm that the access had been granted, I ran the SHOW GRANTS command on the production_raw external location. This step is essential for auditing and ensuring that the correct permissions are in place without granting unnecessary access.

SHOW GRANTS ON EXTERNAL LOCATION production_raw;

principal	actionType	objectType
data_analysts	USE CATALOG	CATALOG
data_engineers	READ FILES	EXTERNAL LOCATION

I noticed that the data_engineers group now has the READ FILES privilege on the production_raw external location. The data_analysts group also has access, which aligns with the existing access control policy. This confirms that the access was granted correctly and that the governance rules are being followed.

Conclusion

By following these steps, I successfully granted read access to the production_raw external location for the data_engineers group while maintaining the governance and security of the production environment. This process reinforced the importance of using Unity Catalog for managing access to external data sources in a controlled and auditable manner.