How to grant access to views without granting access to underlying tables

[alm]

I have a medallion architecture:

• Bronze layer: Raw data in tables
• Silver layer: Refined data in views created from the bronze layer
• Gold layer: Data products as views created from the silver layer

Currently I have a data scientist that needs access to data in the silver layer through Unity Catalog. When he's granted permission (SELECT; USE) to the data in the silver layer, he gets an exception because he does not have USE permission to the data in the bronze layer. If he is granted USE permission, an exception is raised that he does not have SELECT permission to the data in the bronze layer. I do not want to grant him SELECT permission on the raw data.

Is it not possible to grant access to a view without granting access to the underlying table? If not, what is then the use-case of the views?

If this proves to be impossible, what is then the solution? If I make shallow clones, will it solve my problem, or will I encounter something similar?

[Jerry01]

I am also facing the same issue. Do we have a solution for this?

[Tharun-Kumar]

Hi @alm 

Could you let us know which access mode is being used on the Cluster?

[Jerry01]

Tried with single user cluster and shared cluster as well

[alm]

Hi @Tharun-Kumar, 

The problem doesn't occur when using shared access mode, but the shared access isn't supported on ML clusters and so it's a temporary fix only. 

[MoJaMa · Accepted solution]

Single-user clusters use a different security mode which is the reason for this difference.

On single-user/assigned clusters, you'll need the Fine Grained Access Control service (which is a Serverless service) - that is the solution to this problem (also allows you to read tables with RLS/CLM, Dynamic Views and DLT's Streaming Tables and materialized Views - all stuff that is problematic to read on single-user(ie assigned) clusters today)

So, assuming you need Shared ML you need:

1. Service Principal Cluster Preview

2. Fine Grained Access Control Preview.

You can talk to your Databricks Account team to enable these.

[alm]

Thank you for your reply.

This may very well be the solution to the original problem. Our setup has changed since the question was posed, so I won't be able to test the solution.