Databricks Permissions Script

-- =============================================================================
-- AnomalyArmor Databricks Unity Catalog Permissions
-- =============================================================================
-- WHAT THIS GRANTS:
-- - USE CATALOG: Access catalog metadata
-- - USE SCHEMA: Access schema metadata
-- - SELECT: Read table data for freshness checks
--
-- WHAT THIS DOES NOT GRANT:
-- - CREATE: No table/schema/catalog creation
-- - MODIFY: No data modification
-- - MANAGE: No permission management
-- =============================================================================

-- Grant access to the catalog
GRANT USE CATALOG ON CATALOG your_catalog TO `anomalyarmor`;

-- Grant access to all schemas in the catalog
GRANT USE SCHEMA ON CATALOG your_catalog TO `anomalyarmor`;

-- Grant read access to all tables in the catalog
GRANT SELECT ON CATALOG your_catalog TO `anomalyarmor`;

-- Grant catalog access (required)
GRANT USE CATALOG ON CATALOG your_catalog TO `anomalyarmor`;

-- Grant schema access per schema
GRANT USE SCHEMA ON SCHEMA your_catalog.raw TO `anomalyarmor`;
GRANT USE SCHEMA ON SCHEMA your_catalog.staging TO `anomalyarmor`;
GRANT USE SCHEMA ON SCHEMA your_catalog.marts TO `anomalyarmor`;

-- Grant read access per schema
GRANT SELECT ON SCHEMA your_catalog.raw TO `anomalyarmor`;
GRANT SELECT ON SCHEMA your_catalog.staging TO `anomalyarmor`;
GRANT SELECT ON SCHEMA your_catalog.marts TO `anomalyarmor`;

-- Grant permissions to service principal
GRANT USE CATALOG ON CATALOG your_catalog TO `anomalyarmor-monitoring`;
GRANT USE SCHEMA ON CATALOG your_catalog TO `anomalyarmor-monitoring`;
GRANT SELECT ON CATALOG your_catalog TO `anomalyarmor-monitoring`;

-- Run as the AnomalyArmor user/service principal

-- Test 1: Can list schemas
SHOW SCHEMAS IN CATALOG your_catalog;

-- Test 2: Can list tables
SHOW TABLES IN SCHEMA your_catalog.your_schema;

-- Test 3: Can query for freshness
SELECT MAX(event_timestamp) FROM your_catalog.your_schema.your_table;

-- Show grants on catalog
SHOW GRANTS ON CATALOG your_catalog;

-- Show grants to specific user/service principal
SHOW GRANTS TO `anomalyarmor`;

REVOKE SELECT ON CATALOG your_catalog FROM `anomalyarmor`;
REVOKE USE SCHEMA ON CATALOG your_catalog FROM `anomalyarmor`;
REVOKE USE CATALOG ON CATALOG your_catalog FROM `anomalyarmor`;