A data engineer needs to grant a group of analysts `SELECT` access to all tables in a schema named `analytics` in the `prod` catalog. They also need to ensure the analysts can discover the catalog and schema. Which set of GRANT statements achieves least-privilege access for this requirement?

Question

Accepted Answer

B. GRANT USE CATALOG ON CATALOG prod TO analysts_group; GRANT USE SCHEMA ON SCHEMA prod.analytics TO analysts_group; GRANT SELECT ON ALL TABLES IN SCHEMA prod.analytics TO analysts_group. Unity Catalog requires hierarchical privilege grants: users need USE CATALOG on the catalog and USE SCHEMA on the schema to traverse the namespace before they can access tables. Combined with SELECT on the tables, this grants the minimum required privileges. `ALL PRIVILEGES` is over-privileged. Granting `SELECT` on tables alone without `USE CATALOG` and `USE SCHEMA` would fail because the analysts cannot traverse to the tables. `MANAGE` grants administrative control over the schema, which is over-privileged.

A data engineer needs to grant a group of analysts `SELECT` access to all tables in a schema named `analytics` in the `prod` catalog. They also need to ensure the analysts can discover the catalog and schema. Which set of GRANT statements achieves least-privilege access for this requirement?

Related Questions

Discussion

A data engineer needs to grant a group of analysts SELECT access to all tables in a schema named analytics in the prod catalog. They also need to ensure the analysts can discover the catalog and schema. Which set of GRANT statements achieves least-privilege access for this requirement?

Related Questions

Discussion

A data engineer needs to grant a group of analysts `SELECT` access to all tables in a schema named `analytics` in the `prod` catalog. They also need to ensure the analysts can discover the catalog and schema. Which set of GRANT statements achieves least-privilege access for this requirement?