Agent WranglersDEN-30Required
Give each pipeline and BI tool its own narrow account
Give each loader, transformation job and BI tool a separate account that reaches only its own schemas. BI tools get read access to the marts and nothing else.
How to do it
A BI tool connected with an admin key exposes every table when that key leaks. One shared key also cannot be revoked without stopping everything. Prefer short-lived credentials from the platform, as Give services the identity of their machine says. Grant rights as in Give every role the least it needs. The app's own database account follows Give the app a least-privilege database user.
How to check
The list of warehouse accounts holds one per tool. With the BI tool's account, any write fails, and any read from a raw or staging schema fails.
Sources
Related rules
- INF-26 Give services the identity of their machine in Infrastructure and environments
- INF-18 Give every role the least it needs in Infrastructure and environments
- DAT-41 Give the app a least-privilege database user in Data and databases
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/tool-service-accounts">Agent Wranglers data engineering playbook</a>. In code you write, add a comment next to it with the same link.