POST_START
Inspecting Storage Credentials for External Data Access
I recently needed to understand how our team is accessing external storage systems for data processing. I started by checking the list of storage credentials that are currently registered in Unity Catalog. This would give me a high-level overview of what credentials are available and who owns them.
SHOW STORAGE CREDENTIALS;
| name | credential_type | owner |
|---|---|---|
| production_storage | SERVICE_PRINCIPAL | data_platform_admins |
I noticed that there’s a credential named production_storage of type SERVICE_PRINCIPAL, owned by the data_platform_admins group. This suggests that this credential is used for accessing a production storage system, likely with Azure Active Directory credentials.
To get more details about this credential, I ran the DESCRIBE STORAGE CREDENTIAL command. This would help me understand the specific properties of the credential and confirm its configuration.
DESCRIBE STORAGE CREDENTIAL my_storage_credential;
| name | credential_type | owner |
|---|---|---|
| production_storage | SERVICE_PRINCIPAL | data_platform_admins |
The output confirmed that the credential production_storage is of type SERVICE_PRINCIPAL and is owned by the data_platform_admins group. This aligns with my initial observation, and I learned that the name used in the DESCRIBE command is the same as the one listed in the SHOW STORAGE CREDENTIALS output.
Next, I wanted to check who has access to this credential. I ran the SHOW GRANTS ON STORAGE CREDENTIAL command to see the permissions assigned to it. This would help me determine which teams or roles are allowed to use this credential for external data access.
SHOW GRANTS ON STORAGE CREDENTIAL my_storage_credential;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE CATALOG | CATALOG |
| data_engineers | USE CATALOG | CATALOG |
The output showed that the data_analysts and data_engineers groups have the USE CATALOG action on the CATALOG object type. This means they are allowed to use this credential to access external data sources, which is critical for their workflows.
By inspecting the storage credentials, I gained a clear understanding of how our team is managing and granting access to external storage systems. This information is essential for ensuring that only authorized users can access sensitive data and that credentials are properly managed within Unity Catalog.
Leave a Reply