Governance and Unity Catalog

Unity Catalog grants

referenceall clouds2 min readreview needed

Terraform: plural vs singular#

Use databricks_grant (singular) when Terraform and DABs manage the same object. The singular resource manages one principal. It does not remove grants that DABs creates.

The databricks_grants resource is authoritative. It removes grants that its configuration does not define. Use it only when Terraform owns all grants on the object.

The privilege model#

These rules explain the Unity Catalog privilege model. The Unity Catalog access control documentation is the primary source.

  • Data access needs traversal. SELECT on a table is not enough. The principal also needs USE CATALOG on the catalog and USE SCHEMA on the schema. A missing traversal privilege is the most common cause of PERMISSION_DENIED on a table you already granted.
  • BROWSE shows metadata only. A principal with BROWSE sees the object in the explorer and still cannot read it. Grant the action privilege as well.
  • Inheritance covers future children. GRANT SELECT ON SCHEMA reaches every table in that schema, including tables created later. A table-level grant does not.
  • There is no DENY. Absence of a grant is the deny. To lock down one child while a broad parent grant exists, you must narrow the parent grant. A REVOKE on the child does nothing.
  • MANAGE delegates grant administration on a securable without transferring ownership.
  • Own with groups, not people. Access breaks when an individual owner leaves. Use ALTER … OWNER TO a group.
  • Account groups, not workspace-local groups. A grant to a workspace-local group looks applied and has no effect. is_account_group_member('grp') confirms membership.

List the visible direct and inherited table grants:

SELECT grantee, privilege_type, inherited_from
FROM system.information_schema.table_privileges
WHERE table_catalog = 'analytics'
  AND table_schema = 'gold'
  AND table_name = 'customers'
ORDER BY grantee;

This query returns principals, not the users inside each group. It can also omit grants when the caller has MANAGE but does not own the object. Use SHOW GRANTS or Catalog Explorer when you need the complete object grant list.

Row filters and column masks add controls to these grants. They do not replace the grants. See PII and ABAC governance for ABAC policies.

Source: https://learn.microsoft.com/azure/databricks/sql/language-manual/information-schema/table_privileges

Referenced by