datalake security at table row level and region level

Question

hi friends I have a table in a data lake and I want to implement row-level security such as X can view the whole view but for Y the data should be encrypted for that row and same way how to implement region level security X should see asia region data and Y should not see that

Answer 1

Hello @Anshal,

Welcome to the MS Q&A platform.

To implement row-level security in Azure Data Lake Storage Gen1, you can use groups and access control lists (ACLs). You can create a security group for each user or set of users who should have access to the data and then assign the appropriate permissions to the group.

For example, you can create a security group for user X and assign them to read and write permissions, and create a separate security group for user Y and assign them read-only permissions.

Here is a document explaining this:
https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/data-lake-store/data-lake-store-secure-data.md

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/synapse-analytics/metadata/database.md

Data Lake Storage also provides encryption for data stored in the account. You can choose to have your data encrypted or opt for no encryption. If you opt-in for encryption, data stored in Data Lake Storage Gen1 is encrypted before storing on persistent media. In such a case, Data Lake Storage Gen1 automatically encrypts data before persisting and decrypts data before retrieval, which is completely transparent to the client accessing the data. No code change is required on the client side to encrypt/decrypt data.

To implement row-level security for a table in a data lake, you can use the row-level security feature in Azure Synapse Analytics. This feature allows you to control access to specific table rows based on the profile of the user or process running the query.

Reference document:

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/synapse-analytics/guidance/security-white-paper-access-control.md#row-level-security

To implement region-level security, you can use the firewall feature in Data Lake Storage Gen1.

You can specify an IP address range for your trusted clients, and then only clients with IP addresses within that range can access the data store.

Reference: https://learn.microsoft.com/en-us/azure/data-lake-store/data-lake-store-security-overview

I hope this helps. Please let me know if you have any further questions