Protecting Data in Trino

Learn how Immuta enforces policies on data in your Trino environment

In the Trino integration, the Trino Immuta plugin enforces policies on data registered in Immuta at query time. The sequence diagram below outlines the events that occur when an Immuta user who is subscribed to a data source queries it in Trino.

Registering a connection

Trino is configured and data is registered through connections, an Immuta feature that allows administrators to register data objects in a technology through a single connection to make data registration more scalable for your organization.

Once the Trino connection is registered, you can author subscription and data policies in Immuta to enforce access controls.

See the Trino integration reference guide for more details about registering a connection.

Protecting data

After data objects are registered in Immuta, you can author data and subscription policies in Immuta to enforce access controls.

Subscription policies

When a subscription policy is applied to a data source, users who meet the conditions of the policy will be automatically subscribed to the data source. Then, the Trino Immuta plugin will allow the user to query that object.

Consider the following example that illustrates how Immuta enforces a subscription policy that only allows users in the analysts group to access the yellow-table. When this policy is authored and applied to the data source, Trino checks with the Immuta Trino plugin in charge of access control to see if the user should see the table, and the Immuta Trino plugin reaches out to the Immuta API to confirm table access. Once access is confirmed, Trino grants the SELECT privilege on yellow-table to users (registered in Immuta) that are part of the analysts group.

In the image above, the user in the analysts group accesses yellow-table, while the user who is a part of the research group is denied access.

See the Author a subscription policy page for guidance on applying a subscription policy to a data source. See the Subscription policy access types page for details about the subscription policy types supported and Trino privileges Immuta grants on objects registered as Immuta data sources.

Data policies

When a data policy is applied to a data source and a user subscribed to that data source queries it, the Immuta Trino plugin requests the policy definitions from the Immuta API. The Immuta API returns a SQL view expression to the Trino execution engine, which then constructs and executes the SQL statement on the backing catalogs and retrieves the data with appropriate policy enforcement.

In the example below, Immuta sends Trino a SQL view expression that represents the data policy that masks all columns tagged PII. Then, when the user in the analysts group queries yellow-table, which has the PII tag applied to the email column, the Trino execution engine executes that SQL statement and returns the result with the email column masked for that user.

See the Data policies page for guidance on authoring data policies in Immuta and the supported data policies for the Trino integration.