Starburst Galaxy Role Based Access Control RBAC Overview
Monica, Developer Advocate at Starburst, dives into how to create roles, add controls, and more through Starburst Galaxy's UI.
...
Access control is a crucial aspect of any data management system, ensuring that only authorized users can view and manipulate sensitive information. Let’s delve into the exciting access control features offered by Starburst Galaxy, specifically focusing on table-level granularity. We'll explore how these features enable the creation of different roles for various departments within a company, such as HR and marketing. By the end, you'll have a clear understanding of how to leverage Starburst Galaxy's powerful access control capabilities.
Access Control in Starburst Galaxy:
Within Starburst Galaxy, you have the ability to define roles and privileges that dictate users' access to data. By assigning specific privileges to each role, you can control what actions users are permitted to perform. Let's walk through an example of creating roles for the HR and marketing departments to illustrate the process.
Creating Roles:
To begin, navigate to the Roles and Privileges section in Starburst Galaxy. By default, you'll find two pre-existing roles: Account Admin, with unrestricted access, and Public Default, which has limited privileges. In this example, we'll create an HR role and a marketing role.
Configuring HR Role:
Starting with the HR role, ensure that the role can run on the cluster. Then, add the privileges for the tables within the HR schema that the HR role should have access to. Depending on your requirements, you can select different privilege levels for each table. For the HR department, we'll focus on granting select access to the relevant tables.
Configuring Marketing Role:
Next, let's configure the marketing role. Like before, ensure that the role can use the cluster. Then, assign privileges to the tables within the marketing schema that the marketing role requires. In this case, we'll also grant select access to the employee address table in the HR schema, allowing the marketing department to access it for sending company swag.
Fine-Grained Access Control:
Starburst Galaxy offers a wide range of privilege types, enabling granular control over user access. By defining table-level access control, you can specify precisely which actions are allowed on each table. For example, users may only be permitted to select data from the tables, preventing any modification unless done through authorized means like an admin or data pipelines.
Demonstrating Access Control:
Once the privileges are set, you can navigate back to the query editor and run queries to showcase the access control in action. By switching between roles and executing queries, you can observe the differing levels of access granted to each role.
For instance, the HR role will have access to the employee social security number table since it was granted select privileges. On the other hand, the marketing role will be denied access to this table, emphasizing the role-based restrictions. Additionally, both roles will have access to the employee address table, as it was explicitly granted to the marketing role for their specific requirements.
Conclusion:
We've explored the impressive table-level access control features provided by Starburst Galaxy. By creating roles and assigning privileges at the table level, you can finely tune data access for different departments within your organization. Whether it's the HR department's need for specific data or the marketing department's requirements, Starburst Galaxy's access control features offer the flexibility and security needed to protect sensitive information. If you have any questions or need further assistance, don't hesitate to reach out.