topic Re: How to resolve the AnalysisException "DENY is not supported in Unity Catalog" in Data Governance

How to resolve the AnalysisException "DENY is not supported in Unity Catalog"

akashs04 — Fri, 24 Feb 2023 06:08:38 GMT

Hi All,

I am trying to manage access to objects created in a Unity Catalog.

I want the owner/creator of the object(me) to not have access to the object and only the specified users/groups to be able to select/perform other actions on the objects.

But the DENY Command is not supported in Unity Catalog. Is there any other way to deny access to the owner of the objects?

The command I am using is:

%sql

DENY EXECUTE ON FUNCTION catalogName.schemaName.functionTest TO `username@email.com`;

Thanks!

Re: How to resolve the AnalysisException "DENY is not supported in Unity Catalog"

Ajay-Pandey — Fri, 24 Feb 2023 09:56:29 GMT

Hi @Akash Sivadas ,

I think you can do it by data explorer tab.

Please refer below blog for the same-

Manage Unity Catalog permissions in Data Explorer | Databricks on AWS

Re: How to resolve the AnalysisException "DENY is not supported in Unity Catalog"

akashs04 — Fri, 24 Feb 2023 10:15:19 GMT

Hi. Apologies for not being more elaborate about the scenario.

Your solution would work for users who have been granted any permissions to the object but not for the owner of the object. I want the owner of the object to be revoked from accessing this object.

Ideally transferring the object ownership to another user would work. But in my case I am dealing with sensitive data and object creation happens with the help of a Databricks Job. The above mentioned step can be reverted by an admin in the Databricks Workspace. So, this job can still be executed by any other Admin in the Workspace using the owner's credentials to potentially access data.

Re: How to resolve the AnalysisException "DENY is not supported in Unity Catalog"

akashs04 — Fri, 24 Feb 2023 13:31:00 GMT

Hi @Kaniz Fatma

I had already tried that but Databricks throws a ParseException saying possibly unquoted identifier username@email.com detected. Please consider quoting it with back-quoted as `username@email.com`