azure-dbx-unity-catalog-select
SELECT privilege on a Unity Catalog table/schema/catalog grants data-plane read access to the underlying data.
match (effective permission)
{
"action": "databricks:unitycatalog:select",
"scope_type": "table|schema|catalog"
}
where
principal holds Unity Catalog SELECT privilege on the target table, schema, or catalog
the underlying data is in ADLS Gen2, Delta Lake, or an external location
emit
| source type | Identity |
|---|---|
| target type | Data |
| source | <principal> |
| target | <Unity Catalog table/schema/catalog (Data)> |
| permissions | databricks:unitycatalog:select (SELECT privilege on UC object) |
| conditions | iam_permission network_reachability |
Narrative
{principal.name} has SELECT on Unity Catalog object {target.name} and can read its data via a Databricks SQL warehouse or cluster query.
Raw rule rules/derived/azure/databricks.yaml
id: azure-dbx-unity-catalog-select
emits: CanReadData
description: SELECT privilege on a Unity Catalog table/schema/catalog grants data-plane read access to
the underlying data.
match_effective_permission:
action: databricks:unitycatalog:select
scope_type: table|schema|catalog
where:
- principal holds Unity Catalog SELECT privilege on the target table, schema, or catalog
- the underlying data is in ADLS Gen2, Delta Lake, or an external location
emit:
source_type: Identity
target_type: Data
source: <principal>
target: <Unity Catalog table/schema/catalog (Data)>
permissions:
- databricks:unitycatalog:select (SELECT privilege on UC object)
conditions:
- iam_permission
- network_reachability
false_positive_note: SELECT is a data-plane read via the Databricks SQL warehouse or cluster; it does
NOT require direct ADLS RBAC on the underlying storage (the Access Connector MI provides that). The
principal still needs access to a SQL warehouse or cluster to execute the query. Metastore-admin or
catalog-owner SELECT is implicitly included with those roles. Do not emit for tables the principal
has no SELECT on.
narrative: '{principal.name} has SELECT on Unity Catalog object {target.name} and can read its data
via a Databricks SQL warehouse or cluster query.'