azure-dbx-unity-catalog-manage
MANAGE privilege on a Unity Catalog object (catalog/schema/table/storage credential) allows granting access to other principals, including self.
match (effective permission)
{
"action": "databricks:unitycatalog:manage",
"scope_type": "catalog|schema|table|storage_credential|external_location"
}
where
principal holds Unity Catalog MANAGE privilege on the target object (GRANT ... ON <object> TO <principal>)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <any Identity> |
| permissions | databricks:unitycatalog:manage (MANAGE privilege on UC object) |
Narrative
{principal.name} holds Unity Catalog MANAGE on {target.name}; it can GRANT SELECT (or other privileges) on that object to itself or any other principal, bypassing intended data access controls.
Raw rule rules/derived/azure/databricks.yaml
id: azure-dbx-unity-catalog-manage
emits: CanGrantPermission
description: MANAGE privilege on a Unity Catalog object (catalog/schema/table/storage credential) allows
granting access to other principals, including self.
match_effective_permission:
action: databricks:unitycatalog:manage
scope_type: catalog|schema|table|storage_credential|external_location
where:
- principal holds Unity Catalog MANAGE privilege on the target object (GRANT ... ON <object> TO <principal>)
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <any Identity>
permissions:
- databricks:unitycatalog:manage (MANAGE privilege on UC object)
false_positive_note: "MANAGE allows granting to others but does NOT by itself grant SELECT to the holder.\
\ Emit CanGrantPermission; a downstream GRANT SELECT to self would yield CanReadData (from credential-chains\
\ execute-then-read-secret or direct grant). Unity Catalog also supports storage credentials and external\
\ locations \u2014 MANAGE on a storage credential allows granting USAGE to others (data access escalation).\
\ Only emit ACTIVE when the MANAGE privilege is confirmed (SELECT from information_schema or grants\
\ API)."
narrative: '{principal.name} holds Unity Catalog MANAGE on {target.name}; it can GRANT SELECT (or other
privileges) on that object to itself or any other principal, bypassing intended data access controls.'