Data source-specific permissions

To run data quality on a data source, the Edge connection must have the minimum permissions described below.

Important 
  • The Edge connection may be shared with other capabilities, such as Structural Metadata Ingestion, or may be specific to Data Quality & Observability, such as Data Quality Pullup Processing or Data Quality Pushdown Processing.
  • Archive break records permissions currently apply to Data Quality Pushdown Processing only.

Permissions by data source

The following sections list the minimum required permissions for each supported data source, organized by capability. Permissions are listed separately for Structural Metadata Ingestion, Data Quality Pullup Processing and Data Quality Pushdown Processing, and archive break records.

Note Archive break records permissions currently apply to Data Quality Pushdown Processing connections only.

Amazon Athena

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • Read access on the Glue catalog and S3 buckets
  • Write access on the S3 output location
Copy 
{
                        "Version": "YYYY-MM-DD",
                        "Statement": [
                        {
                        "Sid": "VisualEditor0",
                        "Effect": "Allow",
                        "Action": [
                        "athena:StartQueryExecution",
                        "s3:ListBucketMultipartUploads",
                        "athena:GetQueryResultsStream",
                        "glue:GetTables",
                        "glue:GetPartitions",
                        "athena:GetQueryResults",
                        "glue:BatchGetPartition",
                        "s3:ListBucket",
                        "glue:GetDatabases",
                        "athena:ListQueryExecutions",
                        "s3:ListMultipartUploadParts",
                        "glue:GetTable",
                        "glue:GetDatabase",
                        "athena:GetWorkGroup",
                        "s3:PutObject",
                        "s3:GetObject",
                        "glue:GetPartition",
                        "glue:GetCatalogImportStatus",
                        "athena:StopQueryExecution",
                        "athena:GetQueryExecution",
                        "s3:GetBucketLocation",
                        "athena:BatchGetQueryExecution",
                        "athena:DeletePreparedStatement",
                        "athena:CreatePreparedStatement"
                        ],
                        "Resource": [
                        "arn:aws:athena:*:<AWSAccountID>:workgroup/primary",
                        "arn:aws:s3:::<S3 bucket name>/*",
                        "arn:aws:s3:::<S3 bucket name>",
                        "arn:aws:glue:*:<AWSAccountID>:catalog",
                        "arn:aws:glue:*:<AWSAccountID>:database/<database name>",
                        "arn:aws:glue:*:<AWSAccountID>:table/<database name>/*"
                        ]
                        }
                        ]
                    }

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Amazon Redshift

Structural Metadata Ingestion

The service account user must have:

  • USAGE

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • USAGE on schemas
  • SELECT on all tables

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Apache Hive

Structural Metadata Ingestion

The service account user must have:

  • SELECT on each table that you want to process

Data Quality Pullup Processing

The service account user must have:

  • SELECT on each database and table that you want to profile
  • If using Kerberos authentication, the Kerberos principal must have read access on the Hive tables that you want to profile

Azure Synapse

Structural Metadata Ingestion

The service account user must have:

  • SELECT on each table to ingest.

Data Quality Pullup Processing

The service account user must have:

  • GRANT on the login and database
  • SELECT on schemas, tables, and views for processing
  • CONNECT SQL on the system
  • VIEW DEFINITION on the database

Databricks

Structural Metadata Ingestion

The service account user must have:

  • CAN USE on the SQL warehouse
  • USAGE on CATALOG
  • USAGE on SCHEMA
  • SELECT on the schema or tables that you want to process

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • CAN ATTACH TO on the cluster

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Db2

Structural Metadata Ingestion

The service account user must have:

  • CONNECT on the database

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • SELECT on each table that you want to profile

Denodo

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • CONNECT and EXECUTE on the database

Google BigQuery

Structural Metadata Ingestion

The service account user must have:

  • bigquery.datasets.get
  • bigquery.jobs.create
  • bigquery.tables.get
  • bigquery.tables.getData
  • bigquery.tables.list
  • resourcemanager.projects.get

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • roles/bigquery.dataViewer
  • roles/bigquery.jobUser
  • roles/bigquery.readSessionUser on the project
  • roles/bigquery.dataOwner on the temporary dataset

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Microsoft SQL Server

Structural Metadata Ingestion

The service account user must have:

  • CONNECT SQL on the system
  • VIEW DEFINITION on the database

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • GRANT on the login and database
  • SELECT on schemas, tables, and views

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

MySQL

Structural Metadata Ingestion

The service account user must have:

  • SELECT on each database and table that you want to ingest

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • SELECT on each schema that you want to profile

Oracle OCI

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • SELECT on schemas, tables, and views

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Oracle (Thin client-side)

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • SELECT on schemas, tables, and views

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

PostgreSQL

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • USAGE on schemas
  • SELECT on all tables

Presto

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • read-only role on the catalog, schemas, tables, views, and columns

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Salesforce

Structural Metadata Ingestion

The service account user must have:

  • All permissions in the Minimum Access profile and the following:
    • API Enabled administrative option
    • Permission set with the object settings for the standard objects with the READ object permission and Field permissions (fields to read).

Data Quality Pullup Processing

The service account user must have:

  • API Enabled system permission on the service account's profile or permission set
  • Object-level Read on each object that you want to profile
  • Field-level Read on the fields that you want to profile

SAP HANA

Structural Metadata Ingestion

The service account user must have:

  • MONITORING role
  • PUBLIC role

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • SELECT on each schema that you want to profile

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Snowflake

Structural Metadata Ingestion

The service account user must have:

  • USAGE on the database and schema
  • REFERENCES on each table that you want to ingest

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • USAGE on the warehouse, database, and schema
  • SELECT on tables and views

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Starburst

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • read-only role on the catalog, schemas, tables, views, and columns

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.

Sybase

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing

The service account user must have:

  • SELECT on each table and view that you want to profile

Teradata

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing

The service account user must have:

  • SELECT on each table and view that you want to profile

Trino

Structural Metadata Ingestion

No additional permissions required.

Data Quality Pullup Processing and Data Quality Pushdown Processing

The service account user must have:

  • read-only role on the catalog, schemas, tables, views, and columns

Archive break records

When using archive break records, the service account user must have:

  • Read access on the source data.
  • Create, write, and modify table permissions on the destination database and schema where break records are stored. This is separate from the read access used to run the job, and the exact privilege names vary by data source.
Note Unlike other Pushdown data sources, Trino connections require you to create COLLIBRA_DQ_RULES and COLLIBRA_DQ_BREAK_RECORDS manually in your source system before enabling archive break records. Collibra cannot create these objects automatically because DDL syntax and data types vary across Trino-connected platforms. Additionally, some Trino connectors, such as the BigQuery connector, do not support creating views through Trino. In those cases, create the view directly in the underlying platform.

Show setup instructions and examples
  1. Create the COLLIBRA_DQ_RULES table using the DDL for your platform. Example for BigQuery:

    2. Copy
    CREATE TABLE `<catalog>`.`<schema>`.`COLLIBRA_DQ_RULES` (
                                    seqno      BIGINT,
                                    updts      TIMESTAMP(6),
                                    job_uuid   VARCHAR,
                                    dataset    VARCHAR,
                                    run_id     TIMESTAMP(6),
                                    rule_name  VARCHAR,
                                    link_id    VARCHAR,
                                    results    VARCHAR
                            )

  2. Create the COLLIBRA_DQ_BREAK_RECORDS view. Because the Trino BigQuery connector does not support creating views through Trino, create this view directly in BigQuery (not through Trino). Example:


    3. Copy
    CREATE VIEW `<catalog>`.`<schema>`.`collibra_dq_break_records`
                                    AS SELECT
                                    dataset    AS job_name,
                                    job_uuid   AS run_uuid,
                                    run_id     AS run_date,
                                    updts      AS updt_ts,
                                    'Rules'    AS monitor_type,
                                    rule_name  AS monitor_name,
                                    CONCAT('Rule violation for "', rule_name, '"') AS description,
                                    CONCAT('{"metadata":{"rule_name":"', rule_name, '"},"results":', TO_JSON_STRING(results), '}') AS details
            FROM `<catalog>`.`<schema>`.`COLLIBRA_DQ_BREAK_RULES`;