Privileges and securable objects in Unity Catalog

Applies to: check marked yes Databricks SQL Databricks Runtime Unity Catalog only

A privilege is a right granted to a principal to operate on a securable object in the metastore. The privilege model and securable objects differ depending on whether you are using a Unity Catalog metastore or the legacy Hive metastore. This article describes the privilege model for Unity Catalog. If you are using the Hive metastore, see Privileges and securable objects in the Hive metastore.

For detailed information about how to manage privileges in Unity Catalog, see Manage privileges in Unity Catalog.

Note

This article refers to the Unity Catalog privileges and inheritance model in Privilege Model version 1.0. If you created your Unity Catalog metastore during the public preview (before August 25, 2022), you might be on an earlier privilege model that doesn’t support the current inheritance model. You can upgrade to Privilege Model version 1.0 to get privilege inheritance. See Upgrade to privilege inheritance.

Securable objects

A securable object is an object defined in the Unity Catalog metastore on which privileges can be granted to a principal. For a complete list of Unity Catalog securable objects and the privileges that can be granted on them, see Unity Catalog privileges and securable objects.

To manage privileges on any object, you must be its owner or have the MANAGE privilege on the object, as well as USE CATALOG on the object’s parent catalog and USE SCHEMA on its parent schema.

Syntax

securable_object
  { CATALOG [ catalog_name ] |
    CONNECTION connection_name |
    CLEAN ROOM clean_room_name |
    EXTERNAL LOCATION location_name |
    FUNCTION function_name |
    METASTORE |
    SCHEMA schema_name |
    SHARE share_name |
    [ STORAGE | SERVICE ] CREDENTIAL credential_name |
    [ TABLE ] table_name |
    MATERIALIZED VIEW view_name |
    VIEW view_name |
    VOLUME volume_name
  }

You can also specify SERVER instead of CONNECTION and DATABASE instead of SCHEMA.

Parameters

CATALOG catalog_name

Controls access to the entire data catalog.

CLEAN ROOM clean_room_name

Controls access to a clean room.

CONNECTION connection_name

Controls access to the connection.
EXTERNAL LOCATION location_name

Controls access to an external location.
FUNCTION function_name

Controls access to a user-defined function or an MLflow registered model.

MATERIALIZED VIEW view_name

Controls access to a materialized view.

METASTORE

Controls access to the Unity Catalog metastore attached to the workspace. When you manage privileges on a metastore, you do not include the metastore name in a SQL command. Unity Catalog will grant or revoke the privilege on the metastore attached to your workspace.
SCHEMA schema_name

Controls access to a schema.
[ STORAGE | SERVICE ] CREDENTIAL credential_name

Controls access to a credential.

The keywords STORAGE and SERVICE ( Databricks Runtime 15.4 and later) are optional.
SHARE share_name

Controls access on a share to a recipient.
TABLE table_name

Controls access to a managed or external table. If the table cannot be found Databricks raises a TABLE_OR_VIEW_NOT_FOUND error.
VIEW view_name

Controls access to a view. If the view cannot be found Databricks raises a TABLE_OR_VIEW_NOT_FOUND error.
VOLUME volume_name

Controls access to a volume. If the volume cannot be found Databricks raises an error.

Privilege types

For a list of privilege types, see Unity Catalog privileges and securable objects.

Examples

-- Grant a privilege to the user alf@melmak.et
> GRANT SELECT ON TABLE t TO `alf@melmak.et`;

-- Revoke a privilege from the general public group.
> REVOKE USE SCHEMA ON SCHEMA some_schema FROM `alf@melmak.et`;