โ10-29-2024 12:14 AM
Hi.
I want to restrict access to secrets to a security group, as the secrets can be used to retrieve sensitive data only a few people should see. Up until now, we have been using KV-backed secret scopes, but as it's sufficient that Databricks has the (get, list) ACLs for any user to retrieve those secrets using dbutils.secrets.get(), that will not work in this case. How can we restrict access to these secrets?
Best,
Johan.
โ10-29-2024 01:42 AM
You can define "READ" & "MANAGE".
You can set a group e.g. secret_users_group to the secret-scope and assign READ, than only the secret_users_group and MANAGE user has access. All others who are not in the group or not have rights to manage.
โ10-29-2024 12:34 AM
Hi Johan,
this should work for restriction:
https://learn.microsoft.com/en-us/azure/databricks/security/secrets/secrets.
Fine granulat access based on secrets is currently not possible.
BR
โ10-29-2024 01:23 AM
There isn't a "no permission" ACL as far as I am aware - the lowest is "read" which means any user will still be able to read the secrets.
โ10-29-2024 01:42 AM
You can define "READ" & "MANAGE".
You can set a group e.g. secret_users_group to the secret-scope and assign READ, than only the secret_users_group and MANAGE user has access. All others who are not in the group or not have rights to manage.
โ10-29-2024 08:14 PM
Brilliant, thank you! ๐
Join a Regional User Group to connect with local Databricks users. Events will be happening in your city, and you wonโt want to miss the chance to attend and share knowledge.
If there isnโt a group near you, start one and help create a community that brings people together.
Request a New Group