cancel
Showing results for 
Search instead for 
Did you mean: 
Data Engineering
Join discussions on data engineering best practices, architectures, and optimization strategies within the Databricks Community. Exchange insights and solutions with fellow data engineers.
cancel
Showing results for 
Search instead for 
Did you mean: 

How to grant access to views without granting access to underlying tables

alm
New Contributor III

I have a medallion architecture:

  • Bronze layer: Raw data in tables
  • Silver layer: Refined data in views created from the bronze layer
  • Gold layer: Data products as views created from the silver layer

Currently I have a data scientist that needs access to data in the silver layer through Unity Catalog. When he's granted permission (SELECT; USE) to the data in the silver layer, he gets an exception because he does not have USE permission to the data in the bronze layer. If he is granted USE permission, an exception is raised that he does not have SELECT permission to the data in the bronze layer. I do not want to grant him SELECT permission on the raw data.

Is it not possible to grant access to a view without granting access to the underlying table? If not, what is then the use-case of the views?

If this proves to be impossible, what is then the solution? If I make shallow clones, will it solve my problem, or will I encounter something similar?

1 ACCEPTED SOLUTION

Accepted Solutions

MoJaMa
Valued Contributor II
Valued Contributor II

Single-user clusters use a different security mode which is the reason for this difference.

On single-user/assigned clusters, you'll need the Fine Grained Access Control service (which is a Serverless service) - that is the solution to this problem (also allows you to read tables with RLS/CLM, Dynamic Views and DLT's Streaming Tables and materialized Views - all stuff that is problematic to read on single-user(ie assigned) clusters today)

So, assuming you need Shared ML you need:

1. Service Principal Cluster Preview

2. Fine Grained Access Control Preview.

You can talk to your Databricks Account team to enable these.

View solution in original post

6 REPLIES 6

Jerry01
New Contributor III

I am also facing the same issue. Do we have a solution for this?

Tharun-Kumar
Honored Contributor II
Honored Contributor II

Hi @alm 

Could you let us know which access mode is being used on the Cluster?

Jerry01
New Contributor III

Tried with single user cluster and shared cluster as well

alm
New Contributor III

Hi @Tharun-Kumar

The problem doesn't occur when using shared access mode, but the shared access isn't supported on ML clusters and so it's a temporary fix only. 

MoJaMa
Valued Contributor II
Valued Contributor II

Single-user clusters use a different security mode which is the reason for this difference.

On single-user/assigned clusters, you'll need the Fine Grained Access Control service (which is a Serverless service) - that is the solution to this problem (also allows you to read tables with RLS/CLM, Dynamic Views and DLT's Streaming Tables and materialized Views - all stuff that is problematic to read on single-user(ie assigned) clusters today)

So, assuming you need Shared ML you need:

1. Service Principal Cluster Preview

2. Fine Grained Access Control Preview.

You can talk to your Databricks Account team to enable these.

alm
New Contributor III

Thank you for your reply.

This may very well be the solution to the original problem. Our setup has changed since the question was posed, so I won't be able to test the solution. 

Join 100K+ Data Experts: Register Now & Grow with Us!

Excited to expand your horizons with us? Click here to Register and begin your journey to success!

Already a member? Login and join your local regional user group! If there isn’t one near you, fill out this form and we’ll create one for you to join!