Share via

Tutorial: Configure ABAC

Important

This feature is in Beta.

This tutorial introduces how to configure row filter and column mask attribute-based access control (ABAC) policies in Unity Catalog.

In this example, a US analytics team should not be able access EU customer records or SSNs, however they should be able to access other customers and customer data in the same table. This tutorial includes the following:

  1. Enable the tag policies and ABAC Betas
  2. Create a tag policy
  3. Create a Unity Catalog catalog, schema, and table
  4. Apply governed tags to columns
  5. Create a UDF for hiding EU member's data
  6. Create a row filter policy
  7. Create a UDF for hiding SSNs
  8. Create a column mask policy
  9. Select your table using the policies

Step 1: Enable the tag policies and ABAC Betas

  1. As an account admin, log in to the account console.

  2. In the sidebar, click Previews.

  3. Set the Tag policies toggle to On.

  4. As a workspace admin, click your username in the top bar of the Azure Databricks workspace.

  5. From the menu, select Previews.

  6. Set the Attribute Based Access Control toggle to On.

Step 2: Create a tag policy

To create a tag policy, you must have the tag policy CREATE permission at the account level. Account and workspace admins have CREATE by default.

  1. In your Azure Databricks workspace, click Data icon. Catalog.

  2. On the Quick access page, click the Tag Policies > button.

  3. Click Create tag policy.

  4. Enter the tag key pii.

  5. Enter a description for the tag policy.

  6. Enter the allowed values for the tag: ssn and address. Only these values can be assigned to this tag key.

    Tutorial: create a tag policy.

  7. Click Create.

Important

Tag data can be replicated globally. Do not use tag names or values that could compromise the security of your resources. For example, do not use tag names that contain personal or sensitive information.

Step 3: Create the customers table

To follow these steps, you must have the CREATE CATALOG permission on your Unity Catalog metastore. You can also create the table in a schema that you have the CREATE TABLE permission on.

  1. In the sidebar, click +New > Notebook.
  2. Select SQL as your notebook language.
  3. Click Connect and attach the notebook to a compute resource.
  4. Add the following commands to the notebook and run them:
-- Create catalog (if not already exists)
CREATE CATALOG IF NOT EXISTS abac;
USE CATALOG abac;

-- Create schema
CREATE SCHEMA IF NOT EXISTS customers;
USE SCHEMA customers;

-- Create table
CREATE TABLE IF NOT EXISTS profiles (
    First_Name STRING,
    Last_Name STRING,
    Phone_Number STRING,
    Address STRING,
    SSN STRING
)
USING DELTA;

-- Insert data
INSERT INTO profiles (First_Name, Last_Name, Phone_Number, Address, SSN)
VALUES
('John', 'Doe', '123-456-7890', '123 Main St, NY', '123-45-6789'),
('Jane', 'Smith', '234-567-8901', '456 Oak St, CA', '234-56-7890'),
('Alice', 'Johnson', '345-678-9012', '789 Pine St, TX', '345-67-8901'),
('Bob', 'Brown', '456-789-0123', '321 Maple St, FL', '456-78-9012'),
('Charlie', 'Davis', '567-890-1234', '654 Cedar St, IL', '567-89-0123'),
('Emily', 'White', '678-901-2345', '987 Birch St, WA', '678-90-1234'),
('Frank', 'Miller', '789-012-3456', '741 Spruce St, WA', '789-01-2345'),
('Grace', 'Wilson', '890-123-4567', '852 Elm St, NV', '890-12-3456'),
('Hank', 'Moore', '901-234-5678', '963 Walnut St, CO', '901-23-4567'),
('Ivy', 'Taylor', '012-345-6789', '159 Aspen St, AZ', '012-34-5678'),
('Liam', 'Connor', '111-222-3333', '12 Abbey Street, Dublin, Ireland EU', '111-22-3333'),
('Sophie', 'Dubois', '222-333-4444', '45 Rue de Rivoli, Paris, France Europe', '222-33-4444'),
('Hans', 'Müller', '333-444-5555', '78 Berliner Str., Berlin, Germany E.U.', '333-44-5555'),
('Elena', 'Rossi', '444-555-6666', '23 Via Roma, Milan, Italy Europe', '444-55-6666'),
('Johan', 'Andersson', '555-666-7777', '56 Drottninggatan, Stockholm, Sweden EU', '555-66-7777');

Step 4: Add governed tags to the PII columns

  1. Add the following command to the notebook and run it:
-- Add the governed tag to ssn column
ALTER TABLE abac.customers.profiles
ALTER COLUMN SSN
SET TAGS ('pii' = 'ssn');

-- Add governed tag to address column
ALTER TABLE abac.customers.profiles
ALTER COLUMN Address
SET TAGS ('pii' = 'address');

Step 5: Create a UDF to find EU addresses

  1. Add the following command to the notebook and run it:
-- Determine if an address is not in the EU
CREATE OR REPLACE FUNCTION is_not_eu_address(address STRING)
RETURNS BOOLEAN
RETURN (
    SELECT CASE
        WHEN LOWER(address) LIKE '%eu%'
          OR LOWER(address) LIKE '%e.u.%'
          OR LOWER(address) LIKE '%europe%'
        THEN FALSE
        ELSE TRUE
    END
);

This UDF checks whether a given string does not appear to reference Europe or the EU. If any of these substrings are found, it returns FALSE (meaning it is an EU address). If none of the substrings are found, it returns TRUE (meaning it is not an EU address).

Step 6: Create a row filter policy

  1. Click Data icon. Catalog.

  2. Next to the abac catalog, click the kebab menu Kebab menu icon..

  3. Click Open in Catalog Explorer.

  4. Click the Policies tab.

  5. Click New policy.

  6. In General, enter the name hide_eu_customers and description for your policy.

  7. In Principals:

    • In Applied to…, search for and select the principals that the policy applies to. In this example, you can use the group All account users.
    • Leave Except for… blank.

    ABAC filled in policy.

  8. In Type & target:

    • In Policy type, select Row Filter.
    • In Policy target, select the abac catalog for scope of the policy.
    • Leave Table level condition blank.

  9. In Function, select the is_not_eu_address function that you created in abac.customers.

  10. Next to When column, select has tag value.

  11. In Key, select pii and in Value select address.

    ABAC filled in row filter policy.

  12. Click Create policy.

Step 7: Test your policy

  1. Return to your notebook and run the following command:
SELECT DISTINCT * FROM abac.customers.profiles

Only the non-EU resident rows are returned.

First_Name Last_Name Phone_Number Address SSN
Grace Wilson 890-123-4567 852 Elm St, NV 890-12-3456
Alice Johnson 345-678-9012 789 Pine St, TX 345-67-8901
Ivy Taylor 012-345-6789 159 Aspen St, AZ 012-34-5678
Frank Miller 789-012-3456 741 Spruce St, WA 789-01-2345
Jane Smith 234-567-8901 456 Oak St, CA 234-56-7890
John Doe 123-456-7890 123 Main St, NY 123-45-6789
Charlie Davis 567-890-1234 654 Cedar St, IL 567-89-0123
Emily White 678-901-2345 987 Birch St, WA 678-90-1234
Hank Moore 901-234-5678 963 Walnut St, CO 901-23-4567
Bob Brown 456-789-0123 321 Maple St, FL 456-78-9012

You can continue to create a column mask policy.

Step 8: Create a UDF to mask SSNs

  1. Add the following command to the notebook and run it:
-- Masks any SSN input by returning a fully masked value
CREATE FUNCTION mask_SSN(ssn STRING)
RETURN '***-**-****' ;

This UDF returns a fully masked SSN string ('***-**-****'),

Step 9: Create a column mask policy

  1. Click Data icon. Catalog.

  2. Next to the abac catalog, click the kebab menu Kebab menu icon..

  3. Click Open in Catalog Explorer.

  4. Click the Policies tab.

  5. Click New policy.

  6. In General, enter the name mask_ssn and description for your policy.

  7. In Principals:

    • In Applied to…, search for and select the principals that the policy applies to. In this example, you can use the group All account users.
    • Leave Except for… blank.

    ABAC filled in column mask policy.

  8. In Type & target:

    • In Policy type, select Column Mask.
    • In Policy target, select the abac catalog for scope of the policy.
    • Leave Table level condition blank.

  9. In Function, select the mask_SSN function that you created in abac.customers.

  10. Next to When column, select has tag value.

  11. In Key, select pii and in Value select ssn.

    ABAC filled in column mask policy.

  12. Click Create policy.

Step 10: Test your policy

  1. Return to your notebook and run the following command:
SELECT * FROM abac.customers.profiles

The SSNs now return as ***-***-***. Only non-eu residents are returned since the row filter mask is also enabled.

First_Name Last_Name Phone_Number Address SSN
Jane Smith 234-567-8901 456 Oak St, CA ***-**-****
Alice Johnson 345-678-9012 789 Pine St, TX ***-**-****
Charlie Davis 567-890-1234 654 Cedar St, IL ***-**-****
Grace Wilson 890-123-4567 852 Elm St, NV ***-**-****
Bob Brown 456-789-0123 321 Maple St, FL ***-**-****
Hank Moore 901-234-5678 963 Walnut St, CO ***-**-****
Ivy Taylor 012-345-6789 159 Aspen St, AZ ***-**-****
Emily White 678-901-2345 987 Birch St, WA ***-**-****
Frank Miller 789-012-3456 741 Spruce St, WA ***-**-****
John Doe 123-456-7890 123 Main St, NY ***-**-****