Command restrictions

[ElaPG]

Is there any possibility to restrict usage of specified commands (like mount/unmount or SQL grant) based on group assignment? I do not want everybody to be able to execute these commands.

[Wojciech_BUK]

It is not possible to block running specific commands. 

You rather block it in different way e.g. only onwer of catalog, schema or table can grant privilege to object, so you restrict who can be owner.

If someone creates table , he become table owner ( so he can grant access) , so you can block table creation.

[ElaPG]

Thanks for your reply.

1) Regarding objects, such as tables, I can grant or revoke priviligies to users/groups, right?

2) What about mount/unmount commands? Can I specify who can or cannot execute such commands?

[Wojciech_BUK]

Hi 
1) Yes, only if you are e.g. Owner of Schema, then you can Manage Grant of this schema and underlying tabes to others
Please check his docs:
https://docs.databricks.com/en/data-governance/unity-catalog/manage-privileges/ownership.html#owners...

2) Regarding mounts:
I don't think this is possible to restric command itself, if our users will come with valid e.g. Access Key and Storage Account - they will be able to mount the Storage.

I am not sure about below statment but you can check it by yourself:
I think with Unity Catalog enabled cluster with SHARED access mode you won't be able to use or create mounts. If this is correct just grant access to Shared cluster for your end users but please check it before.
Please remember that mounting is not recommended way now as we have External Locations in Unity Catalog 

[ElaPG]

Thanks for advice.

I thought that maybe it is possible to create groups with specified permissions (SQL, python) and this way restrict execute command for e.g. mounting.

[Wojciech_BUK]

If you are ok for users to have only SQL syntax available ( no mounts ) , you can provision SQL warehouse for users , not clusters

[ElaPG]

Unfortunately writing SQL and python code in notebooks is needed.