POST_START

Removing Direct Table Access During an Authorization Cleanup

I recently had the task of cleaning up our authorization setup in Databricks Unity Catalog. As part of this process, I needed to remove direct table access for a group of users who were no longer part of our active team. The first step was to understand what privileges were currently assigned to the table in question.

Checking Current Privileges

I started by running the SHOW GRANTS ON TABLE command to see who had access to the production.sales.orders table.

SHOW GRANTS ON TABLE production.sales.orders;

principal	actionType	objectType
data_analysts	SELECT	TABLE
data_engineers	MODIFY	TABLE

I noticed that the data_analysts group had SELECT access, and the data_engineers group had MODIFY access. This was the baseline before making any changes.

Revoking Unnecessary Access

Next, I decided to revoke the SELECT privilege from the legacy_analysts group, as they were no longer part of our team and had been moved to a different role.

REVOKE SELECT ON TABLE production.sales.orders FROM `legacy_analysts`;

The system confirmed that the privilege was successfully revoked. I made sure to double-check that the group name was correct and that there were no typos in the command.

Verifying the Changes

To ensure that the revocation was applied correctly, I ran the SHOW GRANTS ON TABLE command again to see if the legacy_analysts group was no longer listed.

SHOW GRANTS ON TABLE production.sales.orders;

principal	actionType	objectType
data_analysts	SELECT	TABLE
data_engineers	MODIFY	TABLE

I verified that the legacy_analysts group was no longer present in the list of principals with access. This confirmed that the revocation was applied successfully and that the table access had been removed for the group.

Conclusion

By following these steps, I was able to clean up the authorization setup for the production.sales.orders table. This process helped ensure that only the necessary groups had access to the table, reducing the risk of unauthorized access and maintaining a secure environment.