Walkthrough

Private preview: The Marketplace app is available to select accounts. Contact your Immuta representative for details.

Introduction

Figure 1 depicts the workflows available in the Immuta Marketplace. This walkthrough will guide you through these steps.

Figure 1: Marketplace Workflow

Some of these steps are performed by different user types in Immuta, so this walkthrough is organized by Marketplace user type.

Requirements

See the Marketplace app requirements page.

Governance and user admin users

The data sources that are exposed through your data products are sourced from a domain; so in order to publish a data product, you must have at least one domain with at least one data source in it. Any user with the Immuta GOVERNANCE permission is able to publish data products in the Marketplace app using any Domain. However, this job can be delegated by creating data product managers. You create data product managers by giving them the Manage Data Product permission in a domain.

Figure 2: Delegating to Data Product Managers

As shown in Figure 2, creating a domain and assigning data sources to it is handled by a user with GOVERNANCE permission. Assigning the Manage Data Product permission is handled by a user with USER_ADMIN permission.

These actions are completed in the Governance app, not the Marketplace app.

Data product manager user

This user is able to publish the data products, manage their metadata, and manage request policies. As mentioned above, to be a data product manager, one must have the global GOVERNANCE permission or the domain-specific Manage Data Products permission in a domain.

From there, data product managers are able to publish and manage data products, from their domains, as depicted in Figure 3.

Figure 3: Creating and Managing a Data Product

However, the first step in creating a data product is ensuring that the data sources that make up the data product are contained in the domain where you have the Manage Data Product permission.

Making data sources available to a domain

Typically, you would give a data product manager CREATE permission in a schema or database that they can use as their sandbox for generating new tables/views natively in their data platform using data engineering tools like dbt. Those newly generated tables/views (or even S3 objects) are what they can use as the data sources for their data products.

How do you get these new data objects from the data platform as registered in Immuta and assigned to a domain so that they can be published in data products?

• Immuta automatically registers objects through periodic polling to detect changes in the data platform and represent those changes in Immuta, as data sources. These checks can also be manually triggered.
• Once the objects are registered in Immuta as data sources; they are assigned to a domain manually through the Governance app (or API). A user with GOVERNANCE permission must be involved to add new data sources to domains as they are created. However, this is a short-term limitation, Immuta will soon support automatically adding data sources to a domain based on the schema or database they reside in or based on how they are tagged.

Data consumer user

A data consumer can be anyone with a login to the Immuta. They can visit the Marketplace app, search for data products, and request access, as shown in Figure 4.

Figure 4: Requesting Access

Data steward user

The data stewards are tasked with making determinations on Marketplace access requests, the final step in the workflow depicted in Figure 5.

Figure 5: Access Request Determination

Currently, in the Marketplace private preview, the users with the global GOVERNANCE permission or the domain-specific Manage Data Product permission in the domain must make the determinations on access requests to the data product. It is the default setting in the request policy for the data product. However, soon you will be able to assign any user, group, or permission as data stewards while creating the data product.

When an access request is made that requires approval, that request will appear as pending in the Marketplace, signaling a determination is required. The data steward can make the determination by approving or denying it with a reason, and if approved, Immuta will automatically provision the access, completing the workflow. Soon, there will be an option to temporarily approve access.

Soon the Marketplace app will support notifications (email, Teams, Slack, webhooks) which will allow the users assigned to make an determination on a request to be notified of this, as well as the requestors notified when a determination has been made.

Optional considerations

• Consider branding the Marketplace app with your own logo and colors, to give it the look and feel of your company.
• If you would prefer that data consumers discover data products in your existing catalog, that is possible to configure. The Marketplace app is built in a way so it can present the access request page to the consumer via redirects from your catalog.