Databricks Data Engineer Associate Question 523
Single answerYou are configuring a secure connection between a Databricks workspace and an external cloud storage account. Your organization’s security policies mandate that no personal user credentials should be used in automated workflows. What is the best practice for establishing this connection?
- A
Use personal access tokens (PATs) of the workspace administrator to authenticate the connection.
- B
Use service principals to authenticate the connection and assign the necessary storage permissions.
- C
Use an arbitrary user's cloud account credentials stored in the Databricks secret scope.
- D
Use a shared API key stored in plain text that is accessible to all team members.
Show answer and explanation
Correct answer: B
Explanation
Service principals are a best practice for establishing secure connections in Databricks because they act as non-human identities, are designed for automated workflows, and can have permissions scoped appropriately for access control. This approach aligns with security best practices, such as avoiding the use of personal credentials or shared keys in production environments.
- A. Incorrect.
Using personal access tokens (PATs) tied to individual users is not recommended for automated workflows, as these tokens are tied to specific users and could create security risks if compromised.
- B. Correct.
Using service principals is the best practice because they are identity objects designed for automated workloads, are not tied to a specific user, and can have tightly scoped permissions for enhanced security.
- C. Incorrect.
Using arbitrary user credentials stored in a Databricks secret scope violates the principle of least privilege and is not a best practice because they are tied to specific users and could be revoked if that user leaves the organization.
- D. Incorrect.
Storing a shared API key in plain text is a poor practice as it poses a significant security risk. If exposed, it could allow unauthorized access and is not secure for production environments.