Data engineering teams are increasingly managing data products as code in CI/CD for better version control, automated testing, and faster deployments. With Raito, engineers can define access controls for data products as code in git, while data product owners can use Raito’s UI to manage user access to data products. This lets you integrate data security in the data development processes, and achieve the necessary separation of duties.
Let’s look at the different steps when creating a data product called Sales Analytics Data Product.
Data platform engineer provisions a new environment
When the data platform team provisions a new development environment for a data product they use Raito to provision 3 data product roles in the environment.
These data product roles don’t grant any access yet as they’re empty. It will be up to the data engineer to map those roles to the output ports of the data product, and the data product owner to give users access to the roles. For our Sales Analytics Data Product the role that will be used to give read access will be called ‘Sales Analytics Data Product - Analyst’.
Data engineers gives role access to the data product
Once the development environment is provisioned, the data engineer can develop the data product. As part of the data product definition, the data engineer declares the permissions (e.g. READ, WRITE) the data product roles get to the data product as code. This can be done using our dbt or Terraform-plugins, or by directly calling the Raito API’s. In the below example we see how the data engineer gave the ‘Sales Analytics Data Product - Analyst’ role read permissions to one of the tables of the data product, in dbt
When the engineer promotes the data product to production, Raito automatically promotes the access control to the production environment if it doesn’t exist there yet. If any users have been granted access to the Data Product Role, they will get the same access in production.
Data Product Owner gives users access to the data product role
At any point the data product owner can grant users access to the Data Product Role in 3 ways:
When the data product has been finalised it can be promoted to production. The advantage of using access as code is that the permissions will be promoted to production together with the data product, such that access will be set by default.
Reach out to talk to an expert.
