Privileges and securable objects in Unity Catalog

  • Article

Applies to: check marked yes Databricks SQL check marked yes Databricks Runtime check marked yes Unity Catalog only

A privilege is a right granted to a principal to operate on a securable object in the metastore. The privilege model and securable objects differ depending on whether you are using a Unity Catalog metastore or the legacy Hive metastore. This article describes the privilege model for Unity Catalog. If you are using the Hive metastore, see Privileges and securable objects in the Hive metastore.

For detailed information about how to manage privileges in Unity Catalog, see Manage privileges in Unity Catalog.

Note

This article refers to the Unity Catalog privileges and inheritance model in Privilege Model version 1.0. If you created your Unity Catalog metastore during the public preview (before August 25, 2022), you might be on an earlier privilege model that doesn't support the current inheritance model. You can upgrade to Privilege Model version 1.0 to get privilege inheritance. See Upgrade to privilege inheritance.

Securable objects

A securable object is an object defined in the Unity Catalog metastore on which privileges can be granted to a principal. For a complete list of Unity Catalog securable objects and the privileges that can be granted on them, see Unity Catalog privileges and securable objects.

To manage privileges on any object, you must be its owner.

Syntax

securable_object
  { CATALOG [ catalog_name ] |
    CONNECTION connection_name |
    CLEAN ROOM clean_room_name |
    EXTERNAL LOCATION location_name |
    FUNCTION function_name |
    METASTORE |
    SCHEMA schema_name |
    SHARE share_name |
    [ STORAGE | SERVICE ] CREDENTIAL credential_name |
    [ TABLE ] table_name |
    MATERIALIZED VIEW view_name |
    VIEW view_name |
    VOLUME volume_name
  }

You can also specify SERVER instead of CONNECTION and DATABASE instead of SCHEMA.

Parameters

  • CATALOG catalog_name

    Controls access to the entire data catalog.

  • CONNECTION connection_name

    Controls access to the connection.

  • EXTERNAL LOCATION location_name

    Controls access to an external location.

  • FUNCTION function_name

    Controls access to a user-defined function or an MLflow registered model.

  • MATERIALIZED VIEW view_name

    Controls access to a materialized view.

  • METASTORE

    Controls access to the Unity Catalog metastore attached to the workspace. When you manage privileges on a metastore, you do not include the metastore name in a SQL command. Unity Catalog will grant or revoke the privilege on the metastore attached to your workspace.

  • SCHEMA schema_name

    Controls access to a schema.

  • [ STORAGE | SERVICE ] CREDENTIAL credential_name

    Controls access to a credential.

    The keywords STORAGE and SERVICE (check marked yes Databricks Runtime 15.4 and later) are optional.

  • SHARE share_name

    Controls access on a share to a recipient.

  • TABLE table_name

    Controls access to a managed or external table. If the table cannot be found Azure Databricks raises a TABLE_OR_VIEW_NOT_FOUND error.

  • VIEW view_name

    Controls access to a view. If the view cannot be found Azure Databricks raises a TABLE_OR_VIEW_NOT_FOUND error.

  • VOLUME volume_name

    Controls access to a volume. If the volume cannot be found Azure Databricks raises an error.

Privilege types

For a list of privilege types, see Unity Catalog privileges and securable objects.

Examples

-- Grant a privilege to the user alf@melmak.et
> GRANT SELECT ON TABLE t TO `alf@melmak.et`;

-- Revoke a privilege from the general public group.
> REVOKE USE SCHEMA ON SCHEMA some_schema FROM `alf@melmak.et`;