[Delta Sharing - open sharing protocol] Token rotation

[Leszek]

Hi, 

Do you have any experience of rotating Tokens in Delta Sharing automatically?

There is an option to do that using CLI (Create and manage data recipients for Delta Sharing | Databricks on AWS). 

But what to do next? Sending new link to the token via email automatically to recipient?

[Kaniz]

Hi @Leszek, Rotating tokens in Delta Sharing is a crucial security practice.

Let’s break down the steps:

1. Token Rotation:

   • First, you’ve already taken the right step by using the CLI to create and manage data recipients for Delta Sharing. When you rotate a token, you invalidate the existing token and generate a new one.
   • In Databricks, you can rotate a token as follows:
     • Navigate to Shared by me under the Delta Sharing menu in the left pane.
     • Find and select the recipient for whom you want to rotate the token.
     • On the Details tab, under Token Expiration, click Rotate.
     • You can choose to set the token to expire either immediately or after a specific period¹.

2. Automating Token Delivery:

   • After rotating the token, the next step is to ensure that the recipient receives the new token.
   • While Databricks doesn’t directly handle email notifications, you can set up an automated process to send the new token link via email to the recipient.
   • Here are some options:
     • Custom Script: Write a script that runs periodically (e.g., using a cron job) and checks for token rotations. When a rotation occurs, the script sends an email with the updated token link.
     • Integration with Email Services: Integrate Databricks with an email service (e.g., SendGrid, Amazon SES). When a token is rotated, trigger an email notification containing the new token link.
     • API Calls: Use Databricks REST APIs to automate token rotation and email notifications programmatically.

Remember to secure the token delivery process itself. Ensure that the recipient’s email address is accurate and that the email containing the new token link is sent securely.

Keep in mind that token rotation is essential for maintaining security, especially when sharing sensitive data via Delta Sharing. Establishing a process for regular token rotation helps mitigate risks and ensures that access remai...². 🛡️