Data Platforms Overview

Immuta does not require users to learn a new API or language to access protected data. Instead, Immuta integrates with existing tools and ongoing work while remaining invisible to downstream consumers.

The following data platforms integrate with Immuta:

• Amazon S3 integration: The Amazon S3 integration allows users to apply subscription policies to data in S3 to restrict what prefixes, buckets, or objects users can access. To enforce access controls on this data, Immuta creates S3 grants that are administered by S3 Access Grants, an AWS feature that defines access permissions to data in S3.

• AWS Lake Formation: The AWS Lake Formation connection allows you to register data from Glue Data Catalog.

• Azure Synapse Analytics integration: The Azure Synapse Analytics integration allows Immuta to apply policies directly in Azure Synapse Analytics dedicated SQL pools without needing users to go through a proxy. Instead, users can work within their existing Synapse Studio and have per-user policies dynamically applied at query time.

• Databricks:

  • Databricks Spark integration: This integration enforces policies on Databricks tables registered as data sources in Immuta, allowing users to query policy-enforced data on Databricks clusters (including job clusters). Immuta policies are applied to the plan that Spark builds for users' queries, all executed directly against Databricks tables.

  • Databricks Unity Catalog integration: This integration allows you to manage multiple Databricks workspaces through Unity Catalog while protecting your data with Immuta policies. Instead of manually creating UDFs or granting access to each table in Databricks, you can author your policies in Immuta and have Immuta manage and enforce Unity Catalog access-control policies on your data in Databricks clusters or SQL warehouse.

• Google BigQuery: In this integration, Immuta generates policy-enforced views in your configured Google BigQuery dataset for tables registered as Immuta data sources.

• Redshift integration: With the Redshift integration, Immuta applies policies directly in Redshift. This allows data analysts to query their data directly in Redshift instead of going through a proxy.

• Snowflake integration: With this integration, policies administered in Immuta are pushed down into Snowflake as Snowflake governance features (row access policies and masking policies).

• Starburst (Trino) integration: The Starburst (Trino) integration allows you to access policy-protected data directly in your Starburst (Trino) catalogs without rewriting queries or changing your workflows. Immuta policies are translated into Starburst (Trino) rules and permissions and applied directly to tables within your existing catalogs.

Feature support

The table below outlines the features supported by each of Immuta's integrations.

	Project workspaces	Tag ingestion	User impersonation	Query audit	Multiple integrations
Amazon S3	❌	❌	❌	❌	✅
AWS Lake Formation	❌	❌	❌	❌	❌
Azure Synapse Analytics	❌	❌	✅	❌	✅
Databricks Spark	✅	❌	✅	✅	✅
Databricks Unity Catalog	❌	✅	❌	✅	✅
Google BigQuery	❌	❌	❌	❌	❌
Redshift	❌	❌	✅	❌	✅
Snowflake	✅	✅	✅	✅	✅
Starburst	❌	❌	✅	✅	✅

Policy support

Certain policies are unsupported or supported with caveats*, depending on the integration:

*Supported with caveats:

• On Databricks data sources, joins will not be allowed on data protected with replace with NULL or constant policies.

• Databricks Unity Catalog ARRAY, MAP, or STRUCT type columns only support masking with NULL.

For details about each of these policies, see the Data policy types page.

Audit support for platform queries

The table below outlines what information is included in the query audit logs for each integration where query audit is supported.

	Databricks Spark	Databricks Unity Catalog	Snowflake	Starburst (Trino)
Table and user coverage	Registered data sources and users	All tables and users	Registered data sources and users	Registered data sources and users
Object queried	✅		✅	✅
Columns returned	❌	❌	✅	✅
Query text	✅		✅	✅
Unauthorized information	✅			❌
Policy details	✅	❌	❌	❌
User's entitlements	✅	❌	❌	❌
Column tags	❌	❌	✅	✅
Table tags	❌	❌	✅	❌

Legend:

• ✅ This is available and the information is included in audit logs.

• ❌ This is not available and the information is not included in audit logs.