topic Re: Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment in Data Governance

Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment

Kayl669 — Thu, 12 Jan 2023 16:14:54 GMT

My org is considering a transition from hive metastore to unity catalog. We currently have a workspace for each of dev/uat/production and each of those provide access to their respective blob storage account data. Unity Catalog sits at the account-level and bridges the workspaces; which seem to enable a user (with justifiable access to all envs) to access prod data from any workspace as there doesn't seem to be a way to deny a user the ability to switch catalog (or even set what the default catalog is) within a particular workspace. How can we steer/force users to use each environment-specific workspace as intended?

Re: Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment

LandanG — Thu, 12 Jan 2023 16:36:54 GMT

Hi @James H ,

I believe you're describing something that will be addressed with a feature called "Catalog to workspace bindings". For example, only prod data can be accessed in prod workspaces. This feature is slated to be released hopefully by the end of January

Re: Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment

Kayl669 — Fri, 13 Jan 2023 09:42:42 GMT

I did find this document which indicates that you can set the initial catalog on cluster start:: https://learn.microsoft.com/en-us/azure/databricks/data-governance/unity-catalog/hive-metastore#differences-from-table-access-control

Re: Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment

4kb_nick — Sat, 04 Feb 2023 03:23:03 GMT

This would be really great. I’m helping a client build a new lakehouse in Azure and this is one of the only things I’m stuck on with the proposed architecture. Catalog to workspace binding would really solve that problem.

in the interim, is there any way to leverage cluster policies to force the default catalog on a cluster and prevent the user from changing it?

Re: Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment

js54123875 — Fri, 05 May 2023 15:32:32 GMT

Hi @Landan George - Is "Catalog to workspace bindings" available? I cannot find any documentation on it.

Re: Advice regarding retaining environment-specific access when applying Unity Catalog to workspaces split by environment

Debayan — Thu, 12 Jan 2023 20:09:16 GMT

Hi, Please refer : https://docs.databricks.com/data-governance/unity-catalog/manage-privileges/index.html and let us know if this helps.