topic Re: Restricting access to secrets in Data Engineering

Restricting access to secrets

jar — Tue, 29 Oct 2024 07:14:31 GMT

Hi.

I want to restrict access to secrets to a security group, as the secrets can be used to retrieve sensitive data only a few people should see. Up until now, we have been using KV-backed secret scopes, but as it's sufficient that Databricks has the (get, list) ACLs for any user to retrieve those secrets using dbutils.secrets.get(), that will not work in this case. How can we restrict access to these secrets?

Best,

Johan.

Re: Restricting access to secrets

h_h_ak — Tue, 29 Oct 2024 07:34:02 GMT

Hi Johan,

this should work for restriction:

https://learn.microsoft.com/en-us/azure/databricks/security/secrets/secrets.

Fine granulat access based on secrets is currently not possible.

Re: Restricting access to secrets

jar — Tue, 29 Oct 2024 08:23:04 GMT

There isn't a "no permission" ACL as far as I am aware - the lowest is "read" which means any user will still be able to read the secrets.

Re: Restricting access to secrets

h_h_ak — Tue, 29 Oct 2024 08:42:27 GMT

You can define "READ" & "MANAGE".

You can set a group e.g. secret_users_group to the secret-scope and assign READ, than only the secret_users_group and MANAGE user has access. All others who are not in the group or not have rights to manage.

Re: Restricting access to secrets

jar — Wed, 30 Oct 2024 03:14:51 GMT

Brilliant, thank you! 🙂