Connector guide
Connect Databricks safely
Unity Catalog and SQL warehouse access for organization administrators
1. Create a dedicated service principal
Create a Maya service principal and assign it to a dedicated read-only group. Grant CAN USE on one SQL warehouse, USE CATALOG and USE SCHEMA only on approved Unity Catalog locations, and SELECT only on approved views or tables. Do not grant workspace admin, metastore admin, ownership, cluster creation, or modification privileges.
2. Restrict network and authentication
- Prefer OAuth machine-to-machine authentication with short-lived tokens over personal access tokens.
- Restrict workspace ingress with private connectivity or IP access lists where supported.
- Use a small serverless or pro SQL warehouse with auto-stop and spend controls.
- Keep production and non-production service principals and warehouses separate.
3. Expose only approved data
- Expose curated Unity Catalog views rather than broad bronze or raw data layers.
- Apply row filters, column masks, and tags before granting SELECT.
- Avoid granting access to volumes, secrets, notebooks, model registries, or unrestricted external locations.
- Allowlist exact catalog and schema names in Maya.
4. Verify before connecting
- The principal can query approved objects but cannot alter data, create compute, manage secrets, or administer the workspace.
- Only approved catalogs, schemas, and relations are discoverable.
- Warehouse auto-stop, statement timeout, result limits, and audit delivery are configured.
- OAuth material, query text, and returned sensitive values remain outside general logs and model context.
5. Rotate and revoke
Rotate secrets or keys on a defined schedule and immediately after suspected exposure. Disconnect the integration in Maya before disabling the external identity, and retain only non-sensitive audit metadata.