Linking Data Access to Data Catalog

To fully integrate your data governance landscape, you can link a data source in Data Access to an existing System asset in Data Catalog. This is applicable only to data sources that contain data objects, not to identity stores.

Why link a data source to a System asset

After adding a data source to Data Access, you can link it to a corresponding System asset in Data Catalog. This allows Data Access to automatically map the data objects in the data source (such as databases, schemas, tables, and columns) to the corresponding data assets in Data Catalog.

Such mapping between Data Access and Data Catalog allows you to create a new Data Access role directly from your asset, with Data Access automatically populating the role's data objects. For example, if you create a role from a Data Product Port asset that contains three tables, Data Access populates the new role with those three tables.

Note To be able to create a role from an asset, access requests need to be configured for the asset type with one or more relation types. These relation types define the paths that Data Access follows to find related data assets.

How mapping works

The mapping between a data source in Data Access and its System asset in Data Catalog relies on matching names.

Data Access matches each database, schema, table, and column in the data source to the correspondingly named Database, Schema, Table, and Column asset nested under the System asset in Data Catalog. For the mapping to work, ensure that the System asset's name and the names of its nested assets exactly match the names that are used in the data source. If an asset is renamed in Data Catalog (or a data object is renamed in the data source) without updating the other side, the mapping for that item no longer resolves.

Example: Creating a role from a Data Product Port asset

Suppose that you want to enable self-service access requests for a Data Product Port asset named SALES_PORT, which is related to three Table assets: CUSTOMERS, ORDERS, and PRODUCTS.

Instead of creating a role in Data Access from scratch and then manually adding data objects to it, you can choose to create a role from the asset. This example shows you how the new role is automatically populated with data.

Prerequisites

An administrator has configured access requests for the Data Product Port asset type, with a relation type that links it to the tables that it exposes, that is, "Data Product Port is implemented as Data Product Port Asset".

How it works

0.1. Locating related assets in Data Catalog

When you create a role from the Data Product Port asset, SALES_PORT, Data Access locates all the data assets that are related to the asset based on the configured relation type, "Data Product Port is implemented as Data Product Port Asset". (Table is part of the Data Product Port Asset asset type group, by default.)

Data Access follows the relation path from SALES_PORT to its three tables: CUSTOMERS, ORDERS, and PRODUCTS.

0.2. Resolving assets to data objects

Data Access resolves each of the tables to its corresponding data object in Data Access. To do this, it uses the System asset that is linked to the data source containing the data objects.

  • The Table asset CUSTOMERS is mapped to the data object SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMERS.
  • The Table asset ORDERS is mapped to the data object SNOWFLAKE_PROD.SALES_SCHEMA.ORDERS.
  • The Table asset PRODUCTS is mapped to the data object SNOWFLAKE_PROD.SALES_SCHEMA.PRODUCTS.

0.3. Populating the new role

Data Access automatically populates the new role with the three data objects:

  • SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMERS
  • SNOWFLAKE_PROD.SALES_SCHEMA.ORDERS
  • SNOWFLAKE_PROD.SALES_SCHEMA.PRODUCTS

You can review the permissions before proceeding to create the role. Data Access then creates the role and links it to the SALES_PORT asset. In this way, instead of manually searching across schemas for the correct data objects, you create a role that is scoped to your asset's underlying data.

Example: Creating a role from a Table asset

Suppose that you want to enable self-service access requests for a Table asset named CUSTOMER_TABLE, which is related to two Column assets: CREDIT_CARD_NUMBER and EMAIL_ADDRESS.

Prerequisites

An administrator has configured access requests for the Table asset type with the "Data Asset contains Column" relation type.

How it works

When you create a role from CUSTOMER_TABLE, Data Access follows this relation type to locate the two related columns, then resolves each column to its corresponding data object in Data Access by using the System asset that is linked to the data source.

Note Data Access grants permissions only at the level of data objects that a data source can apply access to. In practice, this means any data object type except columns, for example, tables, views, or schemas. When a related asset resolves to a data object that cannot carry permissions on its own (such as a column), Data Access automatically resolves it to the nearest ancestor data object that can hold permissions. For example, a Column asset typically resolves to its parent table. As a result, creating a role from an asset may populate data objects at a broader level than the starting asset.

Both CREDIT_CARD_NUMBER and EMAIL_ADDRESS columns resolve to the same table, SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMER, so Data Access populates the new role with the SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMER data object.

You can review the permissions before proceeding to create the role. Data Access then creates the role and links it to the CUSTOMER_TABLE asset.

Related topics

Configure access requests