OneLake security data access role replication
This Python notebook provides a basic example for OneLake security data access roles replication between different environments.
At the moment:
- OneLake security roles are only deployed through Fabric deployment pipelines, which only covers the roles defined, not the actual Entra ID user/group member assignments (just permission group assignments).
- On its latest version, fabric-cicd does not deploy OneLake security roles.
How it works:
Through the OneLake security REST APIs, we can take the existing role definition and assignments from a specific environment and replicate them to another entirely.
The example relies on two specific methods:
- List Data Access Roles
- Create Or Update Data Access Roles
This way, we can:
- Persist/modify the already assigned Entra ID users and/or groups to the existing roles from one lakehouse to another.
- Point the existing permission group assignments to the target (workspace + lakehouse).
Credentials for the whole process are provided through NotebookUtils.
⚠️IMPORTANT
- The process, as it is, overwrites the existing roles and assignments at the target with the source's configuration. Any roles and/or assignments non declared at the source will be deleted.
- The identity running the process must have at least the Member role in the referenced workspaces.
- When running under a service principal, token management could require some adjustments, specially if the code does not run inside Fabric.
You can find the notebook here, feel free to adapt the code as needed. For example, once tweaked, it could be used as an step inside an ADO/GitHub pipeline and deploy the existing OneLake roles defined over each lakehouse while replicating the roles established and updating the user/group assignments depending on the deployment environment, complementing fabric-cicd deployments.
Another possible implementation can be done with Terraform. If interested in managing Fabric with Terraform, you can take a look at my GitHub repo.
Hope you find it useful!
