topic Re: How to grant access to views without granting access to underlying tables in Data Engineering

How to grant access to views without granting access to underlying tables

alm — Tue, 30 May 2023 12:43:01 GMT

I have a medallion architecture:

Bronze layer: Raw data in tables
Silver layer: Refined data in views created from the bronze layer
Gold layer: Data products as views created from the silver layer

Currently I have a data scientist that needs access to data in the silver layer through Unity Catalog. When he's granted permission (SELECT; USE) to the data in the silver layer, he gets an exception because he does not have USE permission to the data in the bronze layer. If he is granted USE permission, an exception is raised that he does not have SELECT permission to the data in the bronze layer. I do not want to grant him SELECT permission on the raw data.

Is it not possible to grant access to a view without granting access to the underlying table? If not, what is then the use-case of the views?

If this proves to be impossible, what is then the solution? If I make shallow clones, will it solve my problem, or will I encounter something similar?

Re: How to grant access to views without granting access to underlying tables

Jerry01 — Wed, 26 Jul 2023 16:37:16 GMT

I am also facing the same issue. Do we have a solution for this?

Re: How to grant access to views without granting access to underlying tables

Tharun-Kumar — Thu, 27 Jul 2023 03:45:09 GMT

Hi @alm

Could you let us know which access mode is being used on the Cluster?

Re: How to grant access to views without granting access to underlying tables

Jerry01 — Thu, 27 Jul 2023 18:11:20 GMT

Tried with single user cluster and shared cluster as well

Re: How to grant access to views without granting access to underlying tables

alm — Mon, 31 Jul 2023 04:46:37 GMT

Hi @Tharun-Kumar,

The problem doesn't occur when using shared access mode, but the shared access isn't supported on ML clusters and so it's a temporary fix only.

Re: How to grant access to views without granting access to underlying tables

MoJaMa — Tue, 27 Feb 2024 16:39:37 GMT

Single-user clusters use a different security mode which is the reason for this difference.

On single-user/assigned clusters, you'll need the Fine Grained Access Control service (which is a Serverless service) - that is the solution to this problem (also allows you to read tables with RLS/CLM, Dynamic Views and DLT's Streaming Tables and materialized Views - all stuff that is problematic to read on single-user(ie assigned) clusters today)

So, assuming you need Shared ML you need:

1. Service Principal Cluster Preview

2. Fine Grained Access Control Preview.

You can talk to your Databricks Account team to enable these.

Re: How to grant access to views without granting access to underlying tables

alm — Wed, 28 Feb 2024 08:33:01 GMT

Thank you for your reply.

This may very well be the solution to the original problem. Our setup has changed since the question was posed, so I won't be able to test the solution.