POST_START
Investigating Grant and Revoke Activity During an Authorization Incident
I recently encountered an authorization incident where a user had access to data they shouldn’t have. I needed to trace the source of the unauthorized access by investigating grant and revoke activity in the Unity Catalog. I started by querying the audit logs for any grant actions that might have occurred recently.
SELECT event_time, user_identity, action_name, request_params FROM system.access.audit WHERE action_name LIKE '%grant%' ORDER BY event_time DESC;| event_time | user_identity | action_name | request_params |
|---|---|---|---|
| 2026-09-11 14:32:10 | analyst@demo.com | commandSubmit | {table: production.sales.customers} |
| 2026-09-11 14:31:55 | engineer@demo.com | getTable | {table: production.sales.customers} |
The results showed that the analyst@demo.com had submitted a command to grant access to the at 14:32:10. I noticed that the engineer@demo.com had previously accessed the same table, which raised a red flag. I wanted to check if there was a corresponding revoke action to ensure access was properly managed.
The revoke activity wasn't listed, which meant that the access might still be active. I decided to check the current grants on the
The output revealed that the
I used this information to cross-reference the audit logs and the current grants. I verified that the access was indeed granted, but the user in question wasn't listed as having it. This discrepancy suggested a potential misconfiguration or an unauthorized action that hadn't been revoked.
By analyzing the grant and revoke activity, I was able to trace the source of the unauthorized access and take steps to ensure that only authorized users had access to the data. This experience highlighted the importance of monitoring access changes and regularly auditing grant and revoke actions to maintain data security.production.sales.customers
SELECT event_time, user_identity, action_name, request_params FROM system.access.audit WHERE action_name LIKE '%revoke%' ORDER BY event_time DESC;
event_time
user_identity
action_name
request_params
2026-09-11 14:32:10
analyst@demo.com
commandSubmit
{table: production.sales.customers}
2026-09-11 14:31:55
engineer@demo.com
getTable
{table: production.sales.customers}
production.sales.orders table to see what permissions were in place.
SHOW GRANTS ON TABLE production.sales.orders;
principal
actionType
objectType
data_analysts
SELECT
TABLE
data_engineers
MODIFY
TABLE
data_analysts had SELECT access to the table, and the data_engineers had MODIFY access. This aligned with the earlier grant activity, but I noticed that the analyst who had submitted the grant command wasn't listed as having access. I realized that the access might have been granted to a different principal, or the grant might not have been applied correctly.
Leave a Reply