databricks-security-basics

# Databricks Security Basics ## Overview Implement Databricks security: secret scopes for credential storage, token rotation, least-privilege access via Unity Catalog grants, and security auditing via system tables. Secrets API uses `PUT /api/2.0/secrets/put` and values are automatically redacted in notebook output. ## Prerequisites - Databricks CLI configured - Workspace admin access (for secret scope creation) - Unity Catalog enabled ## Instructions ### Step 1: Create and Manage Secret Scopes ```bash # Create a Databricks-backed secret scope databricks secrets create-scope my-app-secrets # Create Azure Key Vault-backed scope (Azure only) databricks secrets create-scope azure-kv \ --scope-backend-type AZURE_KEYVAULT \ --resource-id "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.KeyVault/vaults/<vault>" \ --dns-name "https://<vault>.vault.azure.net/" # List all scopes databricks secrets list-scopes ``` ### Step 2: Store and Access Secrets ```bash # Store a secret (prompts for value interactively) databricks secrets put-secret my-app-secrets db-password # Store from CLI argument databricks secrets put-secret my-app-secrets api-key --string-value "sk_live_abc123" # List secrets (values always hidden) databricks secrets list-secrets my-app-secrets ``` ```python # Access secrets in notebooks and jobs — values auto-redacted in output db_password = dbutils.secrets.get(scope="my-app-secrets", key="db-password") api_key = dbutils.secrets.get(scope="my-a...