POST_START
Removing Write Access from a Production External Location
I recently had the task of securing a production external location in Databricks Unity Catalog. The location, named production_raw, was being used by several teams, but we needed to remove write access for a legacy ingestion service to prevent accidental or unauthorized data modifications.
Understanding the Current Permissions
I started by checking the current permissions on the production_raw external location. It’s important to understand what privileges are already in place before making any changes. I ran the following command:
SHOW GRANTS ON EXTERNAL LOCATION production_raw;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE CATALOG | CATALOG |
| data_engineers | USE CATALOG | CATALOG |
I noticed that the data_analysts and data_engineers groups had the USE CATALOG privilege, which grants them access to the catalog but not the ability to write files. However, the legacy ingestion service had previously had the WRITE FILES privilege, which I needed to revoke.
Revoking Write Access
To ensure the legacy ingestion service could no longer write to the production_raw location, I executed the revoke command:
REVOKE WRITE FILES ON EXTERNAL LOCATION production_raw FROM `legacy_ingestion`;
Revoke applied successfully; the requested privilege is no longer granted.
The system confirmed that the WRITE FILES privilege was successfully revoked. This step was crucial to prevent any further modifications to the production data by the legacy service. I made sure to double-check that the privilege was removed and that no other groups had unintended write access.
Verifying the Changes
To confirm that the changes were applied correctly, I ran the SHOW GRANTS command again:
SHOW GRANTS ON EXTERNAL LOCATION production_raw;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE CATALOG | CATALOG |
| data_engineers | USE CATALOG | CATALOG |
I verified that the legacy_ingestion group no longer appeared in the list of principals with privileges. This confirmed that the WRITE FILES privilege had been successfully removed. I also made sure that the existing groups still had the necessary USE CATALOG access to continue their work without disruption.
By following these steps, I ensured that the production_raw external location was now secure and that only authorized users could access or use the data in a controlled manner.
Leave a Reply