Starburst (Trino)

Learn about how you can register data from Starburst (Trino) and govern access to that data

This page describes the recommended workflow for setting up Immuta with Starburst (Trino). Following these steps connects your Starburst (Trino) environment, registers users, ingests metadata, and enables automated governance through global policies and access requests.

Before you begin

To complete this workflow, ensure you have:

• Access to a Starburst (Trino) account and the permissions required to configure the connection
• Access to install a plugin on your Trino cluster
• Access to update the Starburst (Trino) config.properties file
• An Immuta application administrator who can register the connection

For the recommended implementation described on this page, you should also have:

• An enterprise identity provider
• Identified owners or stewards for your major data domains
• An understanding of the metadata maintained in your external catalog, if you use one

Completing this workflow typically requires coordination among an Immuta application administrator, a Starburst (Trino) administrator, an identity administrator, governance users, and data stewards.

1

Connect your Starburst (Trino) environment

1. An application administrator will register the Starburst (Trino) connection to allow Immuta to discover databases, schemas, and tables in Starburst (Trino). As object sync runs, Immuta creates corresponding data sources that can be governed through policies or access requests.
2. A Starburst (Trino) admin will install the Immuta plugin and update the Starburst (Trino) config.properties file to allow Immuta to apply policies to Starburst (Trino) securables.
3. After registering the connection, organize your data into domains. Domains assign ownership of data to the appropriate teams and determine who can manage policies, identification, audit, and access workflows for those data sources.

Once your data sources are registered in Immuta and organized into domains, you can apply policy to them.

Start by registering a select Starburst (Trino) business domain by restricting the permissions of the Starburst (Trino) system account. Once your implementation is established, you can onboard additional data sources using the same governance model.

2

Register and map your users

1. Connect your organization's identity provider and configure SSO so that users can authenticate with their existing credentials and be automatically registered in Immuta.

   1. If your identity provider supports SCIM, enable provisioning to synchronize users, groups, and attributes. These attributes can then be used when authoring policies so access automatically changes as the user information in the IAM is synced with Immuta.
2. After your identity provider is configured, map Starburst (Trino) user identities to Immuta users. This ensures that policies written in Immuta are enforced for the correct users when they query data in Starburst (Trino).

Once your users are registered and mapped to their Starburst (Trino) identities, any policies that apply to data sources will be enforced for those users.

If your identity provider supports SCIM, synchronize the user attributes that you plan to reference in policies, such as department, region, or employment type. These attributes provide a strong foundation for reusable global policies.

3

Add metadata to your data

Metadata allows you to author policies that automatically apply across your Starburst (Trino) environment instead of managing individual tables and columns.

1. If your organization already maintains metadata in an external catalog, connect your external catalog so Immuta continuously synchronizes tags, classifications, and descriptions.
2. You can also enable identification to automatically discover and tag sensitive data. Identification is recommended for all deployments and is especially useful if you do not maintain an external catalog.

Once your data sources are tagged in Immuta, you can author global policies based on those tags. These policies can apply automatically as additional data sources are registered through object sync and tagged.

4

Configure automated policies

Once users and metadata are available, begin authoring global policies that automatically protect your data.

1. Create subscription policies to automatically grant access to users who meet the required conditions. You can also use subscription policies to enforce organization-wide requirements, such as limiting access to users with specific attributes or training before access can be granted.
2. Create data policies to mask sensitive columns or filter rows based on metadata such as catalog or identification tags.

Author global policies using metadata and user attributes instead of individual Starburst (Trino) objects or users. This allows the same policies to automatically apply as new data is registered and users are synchronized into Immuta.

A common first policy is to mask sensitive data identified through identification or your external catalog. As new Starburst (Trino) tables are registered and tagged, the policy automatically protects those columns without additional configuration.

5

Configure access requests

Subscription policies can automatically grant access when users meet the required conditions. For access that requires review, configure the Request app.

1. A governance user will create request forms and attach them to assets so users can request access to Starburst (Trino) data from your data catalog.
2. Data stewards can then review and respond to access requests, and Immuta automatically provisions access when requests are approved.

Once access requests are configured, users can request access from your external catalog, and Immuta will route the request for review and provision access when it is approved.

6

Configure audit

After your data, users, and policies are configured, configure audit to export governance activity.

Audit records provide visibility into user queries, policy evaluations, access requests, policy changes, and metadata updates, allowing your organization to monitor how data is accessed and governed across your Starburst (Trino) environment.

Next steps

After completing this workflow, your Starburst (Trino) environment is ready for automated governance. From here you can continue configuring advanced features, refining policies, and onboarding additional Starburst (Trino) data sources. See the Starburst (Trino) integration reference guide for architecture details, platform behavior, and additional configuration options.