The Immuta UI allows users to share, access, and analyze data from one secure location efficiently and easily. This section of documentation introduces all Immuta users to pages and basic features found in the Immuta console.

Immuta UI pages and features

• Data:

  • Data sources: Create, manage, and subscribe to data sources.

  • Projects: Combine data sources, work under specified purposes, and collaborate with other users.

• People: Manage user roles, groups, and attributes.

• Policies: Manage global policies and view all policies and the data sources they apply to.

• Governance: Configure purposes, run governance reports, and view notifications.

• Audit: Analyze how data is being used across your organization.

• Query editor: Write, modify, and execute queries against data sources you're subscribed to in the Immuta UI.

• App settings: Configure Immuta to meet your organization's needs.

• Notifications and activity: View access requests and receive activity updates.

• User profile: Manage username and password, access SQL credentials, and generate API keys.

The Immuta platform solves two of the largest issues facing data-driven organizations: access and control. In large organizations, it can be difficult, if not impossible, for data scientists to access all the data they need. Once they do get access, it’s often difficult to make sure they use the data in ways that are compliant with regulations.

The Immuta platform solves both problems by providing a consistent point of access for all data analysis and dynamically protects your data with complex policies -- enforced based on the user accessing the data and the logic of the policy -- creating efficient digital data exchanges compliant with organizations' regulations with complete visibility of policy enforcement. Benefits include

• Scalability and Evolvability: A scalable and evolvable data management system allows you to make changes that impact thousands of tables at once, accurately. It also allows you to evolve your policies over time with minor changes (or no changes at all) through policy logic.

• Understandability: Immuta can present policies in a natural language form that is easily understood and provide an audit history of change to create a trust and verify environment. This allows you to prove policy is being implemented correctly to business leaders concerned with compliance and risk, and your business can meet audit obligations to external parties or customers.

• Stability and Repeatability: Immuta was built with the “as-code” movement in mind, allowing you to treat Immuta as ephemeral and represent state in source control. You can merge data policy management into your existing engineering paradigms and toolchains, allowing full automation of every component of Immuta. Additionally, time-to-data is reduced across the organization because policy management is stable and time can be spent on other complex initiatives.

• Distributed Stewardship: Immuta enables fine-grained data ownership and controls over organizational domains, allowing a data mesh environment for sharing data - embracing the ubiquity of your organization. You can enable different parts of your organization to manage their data policies in a self-serve manner without involving you in every step, and you can make data available across the organization without the need to centralize both the data and authority over the data. This frees your organization to share more data more quickly.

• Consistency: With inconsistency comes complexity, both for your team and the downstream analysts trying to read data. That complexity from inconsistency removes all value of separating policy from compute. Immuta provides complete consistency so that you can build a policy once, in a single location, and have it enforced scalably and consistently across all your data warehouses.

• Availability: Availability of these highly granular decisions at the access control level can increase data access by over 50% in some cases when using Immuta because friction between compliance and data access is reduced.

• Performance: Performance is tied to how Immuta implements policy enforcement. Rather than requiring a copy of data to be created, Immuta enforces policies live.

Immuta Concepts

User Personas

• Application Admins: Application Admins manage the configuration of Immuta for their organization. These users can configure Immuta to use external identity managers and catalogs, enable or disable data handlers, adjust email and cache settings, generate system API keys, and manage various other advanced settings.

• Data Owners: In order for data to be available in the Immuta platform, a Data Owner — the individual or team responsible for the data — needs to connect their data to Immuta. Once data is connected to Immuta, that data is called a data source. In the process of creating a data source, Data Owners are able to set policies on their data source that restrict which users can access it, which rows within the data a user can access, and which columns within the data source are visible or masked. Data Owners can also decide whether to make their data source public, which makes it available for discovery to all users in the Immuta Web UI, or made private, which means only the Data Owner and its assigned subscribers know it exists.

• Data Users: Data Users consume the data that’s been made available through Immuta. Data Users can browse the Immuta Web UI seeking access to data and easily connect their third-party data science tools to Immuta.

• Project Owners: These users can create their own project to restrict how their data will be utilized using purpose-based restrictions or to efficiently organize their data sources.

• Governors: Governors set Global Policies within Immuta, meaning they can restrict the ways that data is used within Immuta across multiple projects and data sources. Governors can also set purpose-based usage restrictions on projects, which can help limit the ways that data is used within Immuta. By default, Governors can subscribe to data sources; however, this setting can be disabled on the App Settings page. Additionally, users can be a Governor and Admin simultaneously by default, but this setting can also be changed on the App Settings page to render the Governor and Admin roles mutually exclusive.

• Project Managers: These users inspect, manage, approve, and deny various project changes, including purpose requests and project data sources.

• User Admins: Another type of System Administrator is the User Admin, who is able to manage the permissions, attributes, and groups that attach to each user. Permissions are only managed locally within Immuta, but groups and attributes can be managed locally or derived from user management frameworks such as LDAP or Active Directory that are external to Immuta. By default, Admins can subscribe to data sources; however, this setting can be disabled on the App Settings page to remove the Admin's ability to create or subscribe to data sources. Additionally, users can be an Admin and Governor simultaneously by default, but this setting can also be changed on the App Settings page to render the Admin and Governor roles mutually exclusive.

Permissions

Permissions are a system-level mechanism that control what actions a user is allowed to take. These are applied to both the API and UI actions. Permissions can be added to any user by a System Administrator (any user with the USER_ADMIN permission), but the permissions themselves are managed by Immuta and cannot be added or removed in the Immuta UI; however, custom permissions can be created on the App Settings page.

• APPLICATION_ADMIN: Gives the user access to administrative actions for the configuration of Immuta. These actions include

  • Adding external IAMs.

  • Adding ODBC drivers.

  • Adding external catalogs.

  • Configuring email settings.

• AUDIT: Gives the user access to the audit logs.

• CREATE_DATA_SOURCE: Gives the user the ability to create data sources.

• CREATE_DATA_SOURCE_IN_PROJECT: Gives the user the ability to create data sources within a project.

• CREATE_S3_DATASOURCE_WITH_INSTANCE_ROLE: When creating an S3 data source, this allows the user to the handler to assume an AWS Role when ingesting data.

• CREATE_FILTER: Gives the user the ability to create and save a search filter.

• CREATE_PROJECT: Gives the user the ability to create projects.

• FETCH_POLICY_INFO: Gives the user access to an endpoint that returns visibilities, masking information, and filters for a given data source.

• GOVERNANCE: Gives the user the ability to set Global Policies, create purpose-based usage restrictions on projects, and manage tags.

• IMPERSONATE_USER: Allows user to impersonate other Immuta users by entering their own SQL credentials to authenticate with the Immuta Query Engine and then specifying which user they would like to impersonate.

• IMPERSONATE_HDFS_USER: When creating an HDFS data source, this allows the user to enter any HDFS username to use when accessing data.

• PROJECT_MANAGEMENT: Allows users to create purposes, approve and deny purpose requests, and manage project data sources.

• USER_ADMIN: Gives the user access to administrative actions for managing users in Immuta. These include

  • Creating and managing users and groups.

  • Add and remove user permissions.

  • Create and manage user attributes.

Deployment Options

• SaaS: This deployment option provides data access control through Immuta's native integrations, with automatic software updates and no infrastructure or maintenance costs.

• Self-Managed: Immuta supports self-managed deployments for users who store their data on-premises or in private clouds, such as VPC. Users can connect to on-premises data sources and cloud data platforms that run on Amazon Web Services, Microsoft Azure, and Google Cloud Platform.

Immuta does not require users to learn a new API or language to access data exposed there. Instead, Immuta integrates with existing tools and ongoing work while remaining invisible to downstream consumers. This page outlines those integrations.

Snowflake

The Snowflake integration differs based on your Snowflake Edition:

• Snowflake Integration Using Snowflake Governance Features: With this integration, policies administered in Immuta are pushed down into Snowflake as Snowflake governance features (row access policies and masking policies). This integration requires Snowflake Enterprise Edition or higher.

• Snowflake Integration Without Snowflake Governance Features: With this integration, policies administered by Immuta are pushed down into Snowflake as views with a 1-to-1 relationship to the original table and all policy logic is contained in that view.

Click a link below for details about each question:

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Databricks Unity Catalog

This integration allows you to manage multiple Databricks workspaces through Unity Catalog while protecting your data with Immuta policies. Instead of manually creating UDFs or granting access to each table in Databricks, you can author your policies in Immuta and have Immuta manage and enforce Unity Catalog access-control policies on your data in Databricks clusters or SQL warehouse.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Databricks Spark integration with Unity Catalog support

Immuta’s Databricks Spark integration with Unity Catalog support uses a custom Databricks plugin to enforce Immuta policies on a Databricks cluster with Unity Catalog enabled. This integration allows you to add your tables to the Unity Catalog metastore so that you can use the metastore from any workspace while protecting your data with Immuta policies.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Databricks Spark

This integration enforces policies on Databricks tables registered as data sources in Immuta, allowing users to query policy-enforced data on Databricks clusters (including job clusters). Immuta policies are applied to the plan that Spark builds for users' queries, all executed directly against Databricks tables.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Starburst (Trino)

The Starburst (Trino) integration enables Immuta to apply policies directly in Starburst and Trino clusters without going through a proxy. This means users can use their existing Starburst and Trino tooling (querying, reporting, etc.) and have per-user policies dynamically applied at query time.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Starburst (Trino) Integration v2.0

The Starburst (Trino) integration v2.0 allows you to access policy-protected data directly in your Starburst (Trino) catalogs without rewriting queries or changing your workflows. Instead of generating policy-enforced views and adding them to an Immuta catalog that users have to query (like in the legacy Starburst (Trino) integration), Immuta policies are translated into Starburst (Trino) rules and permissions and applied directly to tables within users’ existing catalogs.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Redshift

With the Redshift integration, Immuta applies policies directly in Redshift. This allows data analysts to query their data directly in Redshift instead of going through a proxy.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Azure Synapse Analytics

The Azure Synapse Analytics integration allows Immuta to apply policies directly in Azure Synapse Analytics dedicated SQL pools without needing users to go through a proxy. Instead, users can work within their existing Synapse Studio and have per-user policies dynamically applied at query time.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

7. How do I audit data access?

Amazon S3

The Amazon S3 integration allows users to apply subscription policies to data in S3 to restrict what prefixes, buckets, or objects users can access. To enforce access controls on this data, Immuta creates S3 grants that are administered by S3 Access Grants, an AWS feature that defines access permissions to data in S3.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

Google BigQuery

In this integration, Immuta generates policy-enforced views in your configured Google BigQuery dataset for tables registered as Immuta data sources.

1. How does my integration work in Immuta?

2. How do I configure it?

3. How do I connect my data?

4. How do I protect my data?

5. How do I manage data sources?

6. How do I access and query data?

External Catalogs

Users who want to use tagging capabilities outside of Immuta and pull tags from external table schemas can connect Collibra or Alation as an external catalog. Once they have been connected, Immuta will ingest a data dictionary from the catalog that will apply data source and column tags directly onto data sources. These tags can then be used to write and drive policies.

If users have another catalog, or have customized their Collibra or Alation integrations, they can connection through the REST Catalog using the Immuta API.

Users can also connect a Snowflake account to allow Immuta to ingest Snowflake tags onto Snowflake data sources.

1. How does my catalog work with Immuta?

2. How do I configure it?

3. How do I automatically discover and tag sensitive data?

External IAMs

External identity managers configured in Immuta allow users to authenticate using an existing identity management system and can optionally be used to synchronize user groups and attributes into Immuta.

1. How does my identity manager work with Immuta?

2. How do I configure it?

Feature, Audit, and Policy Support

Feature Support

The table below outlines the features supported by each of Immuta's integrations.