POST_START
Tracing Read Access Through Catalog Schema and Table Grants
I was tasked with understanding how read access to a specific table in the Unity Catalog was granted. My goal was to trace the permissions from the catalog level down to the table level to ensure that only the right users could access the data. I started by checking the grants at the catalog level to get a high-level view of who had access.
SHOW GRANTS ON CATALOG production;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE CATALOG | CATALOG |
| data_engineers | CREATE SCHEMA | CATALOG |
I noticed that the data_analysts group had the USE CATALOG privilege, which means they could access the catalog and its contents. The data_engineers group had the CREATE SCHEMA privilege, which implies they could create schemas within the catalog, but not necessarily access existing ones.
Next, I wanted to look at the grants at the schema level to see who had access to the sales schema within the production catalog. I ran the following command.
SHOW GRANTS ON SCHEMA production.sales;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | USE SCHEMA | SCHEMA |
| data_engineers | CREATE TABLE | SCHEMA |
I learned that the data_analysts group had the USE SCHEMA privilege, which means they could access the sales schema. This was a key step in understanding how the read access was being granted, as being able to use the schema is a prerequisite for accessing its tables.
Finally, I wanted to check the specific table, orders, within the sales schema to see who had read access. I executed the following command.
SHOW GRANTS ON TABLE production.sales.orders;
| principal | actionType | objectType |
|---|---|---|
| data_analysts | SELECT | TABLE |
| data_engineers | MODIFY | TABLE |
This confirmed that the data_analysts group had the SELECT privilege on the orders table, which means they could read the data. The data_engineers group had the MODIFY privilege, which allows them to edit or update the table, but not read it.
By tracing the grants from the catalog down to the table, I was able to clearly see the access control structure. This helped me understand how different groups interacted with the data and ensured that the access levels were aligned with the security policies in place.
Leave a Reply