Managing Data Access and Ownership in Unity Catalog: A Guide to Privileges and Rules

Privileges in Unity Catalog Source: Databricks

Unity Catalog is a metadata management system provided by Databricks to manage data assets in the cloud. With Unity Catalog, users can create, organize, and discover datasets, tables, views, and other data assets across different cloud platforms.
In the previous article, we talked about Identities in Unity Catalog. In this article, we will discuss data access rules and how to manage data ownership in Unity Catalog.

Data Access Rules in Unity Catalog

Data access rules determine who can access, modify, and delete data assets in Unity Catalog. By default, only the owner of a dataset, table, or view can modify or delete it. However, the owner can grant access to other users or groups by assigning appropriate privileges.

Privileges are permissions that allow users to perform specific actions on data assets. There are several types of privileges in Unity Catalog, including:

• CREATE: allows users to create new data assets, such as tables or views.
• USAGE: allows users to use an existing data asset, such as running queries on a table or view.
• SELECT: allows users to read data from a table or view.
• MODIFY: allows users to modify data in a table or view.
• CREATE TABLE: allows users to create new tables in a database.
• READ FILES: allows users to read the contents of a file.
• WRITE FILES: allows users to create or modify a file in Unity Catalog.
• EXECUTE: allows users to execute a command or script in Unity Catalog.

Privileges can be assigned at different levels in the Unity Catalog hierarchy, including:

• Catalog level: privileges assigned at the top-level apply to all data assets in the catalog.
• Database level: privileges assigned at the database level apply to all data assets in the database.
• Table level: privileges assigned at the table level apply to specific tables.

Managing Data Ownership in Unity Catalog

Data ownership in Unity Catalog is determined by the user who creates the data asset. The owner has full control over the asset, including the ability to modify or delete it. It is important to note that granting privileges at a parent level does not propagate to child levels in the Unity Catalog hierarchy. For example, if a user has USAGE access to a database, they will not automatically have USAGE access to all tables in the database.

Example of Accessing a Table in Unity Catalog

To access a table in Unity Catalog, the following privileges may be required:

• USAGE privilege on the catalog that contains the table.
• USAGE privilege on the database that contains the table.
• SELECT privilege on the table.

In conclusion, Unity Catalog provides a powerful metadata management system for managing data assets in the cloud. Data access rules and data ownership are important concepts to understand when working with Unity Catalog. By assigning appropriate privileges, users can control who can access, modify, and delete data assets in the catalog.

If you found the article to be helpful, you can buy me a coffee here:
Buy Me A Coffee.