Connections

Public preview

This feature is public preview and available to select accounts. Reach out to your Immuta support professional to enable it on your tenant.

Connections allow you to register your data objects in a technology through a single connection, making data registration more scalable for your organization. Instead of registering schema and databases individually, you can register them all at once and allow Immuta to monitor your data platform for changes so that data sources are added and removed automatically to reflect the state of data on your data platform.

Once you register your connection, Immuta presents a hierarchical view of your data that reflects the hierarchy of objects in your data platform:

• Account (Snowflake) or Metastore (Databricks Unity Catalog)

• Database

• Schema

• Tables: These represent the individual objects in your data platform, and when active, become data sources

Beyond making the registration of your data more intuitive, connections provides more control. Instead of performing operations on individual schemas or tables, you can perform operations (such as object sync) at the connection level.

Requirements

See the Snowflake or Databricks Unity Catalog connection registration how-to guides for a list of requirements.

Object sync

Immuta will ensure the objects in your database stay synchronous with the registered objects in Immuta. To do this, Immuta uses the account credentials provided during registration to check the remote technology for object changes like a table being created, new columns being added to a table, or a table being deleted.

If tables are added, new data sources are created in Immuta. If remote tables are deleted, the corresponding data sources and data objects will be removed from Immuta. And if a column changes in a table, those changes will be reflected in the Immuta data source data dictionary.

Your connection can be synced in two ways:

• Periodic object sync: This happens once every 24 hours (at 1:00 AM UTC). Currently, updating this schedule is not configurable.

• Manual object sync: You can manually run object sync on your connection.

Tracking new data source columns

When new columns are detected and added to Immuta, they will be automatically tagged with the New tag. This allows governors to use the seeded New Column Added global policy to mask columns with the New tag, since they could contain sensitive data.

The New Column Added global policy is staged (inactive) by default. See the Clone, activate, or stage a global policy guide to activate this seeded global policy if you want any columns with the New tag to be automatically masked.

Without connections, schema monitoring would also tag new data sources with the New tag. However this behavior is exclusive to schema monitoring and will not happen with object sync. Object sync only tags new columns of known data sources with the New tag.

Data source requests

When there is an active policy that targets the New tag, Immuta sends validation requests to data owners for the following changes made in the remote data platform:

• Column added: Immuta applies the New tag on the column that has been added and sends a request to the data owner to validate if the new column contains sensitive data. Once the data owner confirms they have validated the content of the column, Immuta removes the New tag from it and as a result any policy that targets the New column tag no longer applies.

• Column deleted: Immuta deletes the column from the data source's data dictionary in Immuta. Then, Immuta sends a request to the data owner to validate the deleted column.

For instructions on how to view and manage your tasks and requests in the Immuta UI, see the Manage access requests guide. To view and manage your tasks and requests via the Immuta API, see the Manage data source requests section of the API documentation.

Default settings

When registering a connection, Immuta sets the connection to the recommended default settings to protect your . The recommended settings are described below:

• Object sync: This setting allows Immuta to monitor the connection for changes. When Immuta identifies a new table, a data source will automatically be created. Similarly, if remote tables are deleted, the corresponding data sources and data objects will be deleted in Immuta. This setting is enabled by default and cannot be disabled.

• Default run schedule: This sets the time interval for Immuta to check for new objects. By default, this schedule is set to 24 hours.

• Sensitive data discovery: This setting enables sensitive data discovery and allows you to select the sensitive data discovery framework that Immuta will apply to your data objects. This setting is enabled by default to use the preconfigured or global framework.

• Impersonation: This setting enable and defines the role for user impersonation in Snowflake. User impersonation is not supported in the Databricks Unity Catalog integration. This setting is disabled by default.

• Project workspaces: This setting enables Snowflake project workspaces. If you use Snowflake secure data sharing with Immuta, enable this setting, as project workspaces are required. If you use Snowflake table grants, disable this setting; project workspaces cannot be used when Snowflake table grants are enabled. Project workspaces are not supported in the Databricks Unity Catalog integration. This setting is disabled by default.

Deregistering a connection

Deregistering a connection automatically deletes all of its child objects in Immuta. However, Immuta will not remove the objects in your Snowflake or Databricks account.

Limitations

• Snowflake and Databricks Unity Catalog are currently the only integrations that support connections

• Databricks Unity Catalog: Delta shares are unsupported.

Related guides

How-to guides

• Register a Snowflake connection

• Register a Databricks connection

Reference guides

• Snowflake integration reference guide

• Databricks Unity Catalog reference guide

• Policies in Immuta

• Data sources in Immuta