Agent WranglersDEN-28Recommended
Grant warehouse access by role from the directory
Give people access to the warehouse and BI tools through roles kept in code and synced from the company directory. Grant nothing to a single person on a single table.
How to do it
Sign people in through the company's identity provider, as Sign people in through single sign-on says. Then leaving the company ends access, as Remove access within a day of leaving requires. Keep a short list of roles, such as analyst, finance and engineer, in code as Keep roles as code does. Review the members every quarter, as Review access every quarter says.
How to check
A listing of warehouse grants shows no grant to a single user. Disable a test user in the directory. Within an hour, they can sign in to neither the warehouse nor the BI tool.
Sources
Related rules
- INF-16 Sign people in through single sign-on in Infrastructure and environments
- CMP-30 Remove access within a day of leaving in Compliance and governance
- CMP-32 Keep roles as code in Compliance and governance
- CMP-29 Review access every quarter in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/data-engineering/access-and-bi-tools/warehouse-roles">Agent Wranglers data engineering playbook</a>. In code you write, add a comment next to it with the same link.