> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/saas/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/saas/~/changes/l3NnvynMHxi6VvqRtJhK/integrations/starburst-trino/how-to-guides/write-access-mapping.md).

# Customize Read and Write Access Policies for Starburst (Trino)

{% hint style="info" %}
**Private preview**: Write policies are only available to select accounts. Contact your Immuta representative to enable this feature.
{% endhint %}

## Requirements

* Starburst (Trino) version 438 or newer
* Write policies for Starburst (Trino) enabled. Contact your Immuta representative to get this feature enabled on your account.

## Configuration options

In its default setting, the Starburst (Trino) integration's write access value controls the authorization of SQL operations that perform data modification (such as `INSERT`, `UPDATE`, `DELETE`, `MERGE`, and `TRUNCATE`). However, administrators can allow table modification operations (such as `ALTER` and `DROP` tables) to be authorized as write operations. Two locations allow administrators to specify how [read and write access policies](/saas/~/changes/l3NnvynMHxi6VvqRtJhK/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types.md) are applied to data in Starburst (Trino). Select one or both of the options below to customize these settings. If the `access-control.properties` file is used, it may override the policies configured in the Immuta web service.

* **Immuta web service**: Configure write policies in the Immuta web service to allow all Starburst (Trino) clusters targeting that Immuta tenant to receive the same write policy configuration for data sources. This configuration will only affect tables or views registered as Immuta data sources.
* **Starburst (Trino) cluster**: Configure write policies using the `access-control.properties` file in [Starburst](/saas/~/changes/l3NnvynMHxi6VvqRtJhK/integrations/starburst-trino/how-to-guides/configure.md#id-2-configure-the-immuta-system-access-control-plugin-in-starburst) or [Trino](/saas/~/changes/l3NnvynMHxi6VvqRtJhK/integrations/starburst-trino/how-to-guides/configure.md#id-2-configure-the-immuta-system-access-control-plugin-in-trino) to broadly customize access for Immuta users on a specific cluster. This configuration file takes precedence over write policies passed from the Immuta web service. Use this option if all Immuta users should have the same level of access to tables regardless of the write policy setting in the Immuta web service.

### Immuta web service configuration

Contact your Immuta representative to configure read and write access in the Immuta web service if all Starburst (Trino) data source operations should be affected identically across Starburst (Trino) clusters connected to your Immuta tenant. A configuration example is provided below.

#### Configuration example

The following example maps `WRITE` to `READ`, `WRITE` and `OWN` permissions and `READ` to just `READ`. Both `READ` and `WRITE` permissions should always include `READ`:

```yaml
accessGrantMapping:
  WRITE: ['READ', 'WRITE', 'OWN']
  READ: ['READ']
```

Given the above configuration, when a user gets write access to a Starburst (Trino) data source, they will have both data and table modification permissions on that data source. See the [Starburst (Trino) privileges section of the Subscription policy access types guide](/saas/~/changes/l3NnvynMHxi6VvqRtJhK/secure-your-data/authoring-policies-in-secure/section-contents/reference-guides/subscription-access-types.md#granting-starburst-trino-privileges) for details about these operations.

### Starburst cluster configuration

Configure the integration to allow read and write policies to apply to any data source (registered or unregistered in Immuta) on a Starburst cluster.

1. Create the Immuta access control configuration file in the Starburst configuration directory (**`/etc/starburst/immuta-access-control.properties`** for Docker installations or **`<starburst_install_directory>/etc/immuta-access-control.properties`** for standalone installations).
2. Modify one or both properties below to customize the behavior of read or write access policies for all users:

   * **`immuta.allowed.immuta.datasource.operations`**: This property governs objects (catalogs, schemas, tables, etc.) that are registered as data sources in Immuta. For these permissions to apply, the user must be subscribed to the data source in Immuta and not be an administrator (who gets all permissions).
     * `READ`: Grants `SELECT` on tables or views; grants `SHOW` on tables, views, or columns
     * `WRITE`: Grants `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or `TRUNCATE` on tables; grants `REFRESH` on materialized views.
     * `OWN`: Grants `ALTER` and `DROP` on tables; grants `SET` on comments and properties
   * **`immuta.allowed.non.immuta.datasource.operations`**: This property governs objects (catalogs, schemas, tables, etc.) that are not registered as data sources in Immuta. Use all or a combination of the following access values:
     * `READ`: Grants `SELECT` on tables or views; grants `SHOW` on tables, views, or columns
     * `WRITE`: Grants `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or `TRUNCATE` on tables; grants `REFRESH` on materialized views.
     * `OWN`: Grants `ALTER` and `DROP` on tables; grants `SET` on comments and properties
     * `CREATE`: Grants `CREATE` on catalogs, schema, tables, and views. *This is the only property that can allow `CREATE` permissions, since `CREATE` is enforced on new objects that do not exist in Starburst or Immuta yet (such as a new table being created with `CREATE TABLE`).*

   For example, the following configuration allows `READ`, `WRITE`, and `OWN` operations to be authorized on data sources registered in Immuta and all operations are permitted on data that is not registered in Immuta:

   ```shell
   immuta.allowed.immuta.datasource.operations=READ,WRITE,OWN
   immuta.allowed.non.immuta.datasource.operations=READ,WRITE,CREATE,OWN
   ```
3. Enable the Immuta access control plugin in the Starburst cluster's configuration file (**`/etc/starburst/config.properties`** for Docker installations or **`<starburst_install_directory>/etc/config.properties`** for standalone installations). For example,

   ```conf
   access-control.config-files=/etc/starburst/immuta-access-control.properties
   ```

### Trino cluster configuration

1. Create the Immuta access control configuration file in the Trino configuration directory (**`/etc/trino/config.properties`** for Docker installations or **`<trino_install_directory>/etc/config.properties`** for standalone installations).
2. Modify one or both properties below to customize the behavior of read or write access policies for all users:

   * **`immuta.allowed.immuta.datasource.operations`**: This property governs objects (catalogs, schemas, tables, etc.) that are registered as data sources in Immuta. For these permissions to apply, the user must be subscribed to the data source in Immuta and not be an administrator (who gets all permissions).
     * `READ`: Grants `SELECT` on tables or views; grants `SHOW` on tables, views, or columns
     * `WRITE`: Grants `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or `TRUNCATE` on tables; grants `REFRESH` on materialized views.
     * `OWN`: Grants `ALTER` and `DROP` on tables; grants `SET` on comments and properties
   * **`immuta.allowed.non.immuta.datasource.operations`**: This property governs objects (catalogs, schemas, tables, etc.) that are not registered as data sources in Immuta. Use all or a combination of the following access values:
     * `READ`: Grants `SELECT` on tables or views; grants `SHOW` on tables, views, or columns
     * `WRITE`: Grants `INSERT`, `UPDATE`, `DELETE`, `MERGE`, or `TRUNCATE` on tables; grants `REFRESH` on materialized views.
     * `OWN`: Grants `ALTER` and `DROP` on tables; grants `SET` on comments and properties
     * `CREATE`: Grants `CREATE` on catalogs, schema, tables, and views. *This is the only property that can allow `CREATE` permissions, since `CREATE` is enforced on new objects that do not exist in Starburst or Immuta yet (such as a new table being created with `CREATE TABLE`).*

   For example, the following configuration allows `READ`, `WRITE`, and `OWN` operations to be authorized on data sources registered in Immuta and all operations are permitted on data that is not registered in Immuta:

   ```shell
   immuta.allowed.immuta.datasource.operations=READ,WRITE,OWN
   immuta.allowed.non.immuta.datasource.operations=READ,WRITE,CREATE,OWN
   ```
3. Enable the Immuta access control plugin in Trino's configuration file (**`/etc/trino/config.properties`** for Docker installations or **`<trino_install_directory>/etc/config.properties`** for standalone installations). For example,

   ```conf
   access-control.config-files=/etc/trino/immuta-access-control.properties
   ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.immuta.com/saas/~/changes/l3NnvynMHxi6VvqRtJhK/integrations/starburst-trino/how-to-guides/write-access-mapping.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.