Linking data source to System asset

To fully integrate your data governance landscape, you can link your data source in Data Access to an existing System asset in Data Catalog. This is applicable only to data sources that contain data objects, not to identity stores.

Why link a data source to a System asset

After adding a data source to Data Access, you can link it to a corresponding System asset in Data Catalog. This allows Data Access to automatically map the data objects in the data source (such as databases, schemas, tables, and columns) to the corresponding data assets in Data Catalog. Such mapping enables you to create a new Data Access role directly from your asset. For example, if you create a role from a Data Product Port asset that contains three tables, Data Access can then populate the new role with those three tables.

Note To be able to create a role from an asset, access requests need to be configured for the asset type with one or more relation types.

Example: Creating a role from a Data Product Port asset

Suppose that you are a data owner and you want to enable self-service access requests for a Data Product Port asset named SALES_PORT. Instead of creating a role in Data Access from scratch and then manually adding data objects to it, you can choose to create a role from the asset. This example shows you how the new role is automatically populated with data.

Prerequisites

  • The Data Product Port asset, SALES_PORT, is related to three Table assets: CUSTOMERS, ORDERS, and PRODUCTS.
  • An administrator has configured access requests for the Data Product Port asset type with a relation type that links it to the tables that it exposes, that is, "Data Product Port is implemented as Data Product Port Asset".

Locating related assets in Data Catalog

When you create a role from the Data Product Port asset, SALES_PORT, Data Access locates all the data assets that are related to the asset based on the configured relation type, "Data Product Port is implemented as Data Product Port Asset". (Table is part of the Data Product Port Asset asset type group, by default.)

Data Access follows the relation path from SALES_PORT to the three tables that it exposes: CUSTOMERS, ORDERS, and PRODUCTS.

Resolving assets to data objects

Data Access resolves each of the tables that SALES_PORT exposes to its corresponding data object in Data Access. To do this, it uses the System asset that is linked to the data source containing the data objects.

  • The Table asset CUSTOMERS is mapped to the data object SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMERS.
  • The Table asset ORDERS is mapped to the data object SNOWFLAKE_PROD.SALES_SCHEMA.ORDERS.
  • The Table asset PRODUCTS is mapped to the data object SNOWFLAKE_PROD.SALES_SCHEMA.PRODUCTS.

Populating the new role

Data Access automatically populates the new role with the following data objects:

  • SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMERS
  • SNOWFLAKE_PROD.SALES_SCHEMA.ORDERS
  • SNOWFLAKE_PROD.SALES_SCHEMA.PRODUCTS

You can review the permissions before proceeding to create the role. Data Access then creates the role and links it to the SALES_PORT asset.

In this way, instead of manually searching across schemas to find and select the correct data objects, you can create a role that is scoped to your asset's underlying data.

Example: Creating a role from a Table asset

Suppose that you are a data owner and you want to enable self-service access requests for a Table asset named CUSTOMER_TABLE, which is related to two Column assets: CREDIT_CARD_NUMBER and EMAIL_ADDRESS.

An administrator has configured access requests for the Table asset type with the "Data Asset contains Column" relation type.

When you create a role from CUSTOMER_TABLE, Data Access follows this relation type to locate the two related columns, then resolves each column to its corresponding data object in Data Access by using the System asset that is linked to the data source.

Data Access grants access at the level of data objects that can carry permissions in the data source, such as tables, views, or schemas. Because columns cannot hold permissions on their own, each column resolves to its nearest data object that can hold permissions, which, in this case, is the parent table.

Both CREDIT_CARD_NUMBER and EMAIL_ADDRESS resolve to the same data object, SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMER. Because both columns resolve to the same table, Data Access de-duplicates the result to a single entry and populates the new role with the SNOWFLAKE_PROD.SALES_SCHEMA.CUSTOMER data object.

You can review the permissions before proceeding to create the role. Data Access then creates the role and links it to the CUSTOMER_TABLE asset.

Related topics

Configure access requests