보안 개요

# 1. Secret Scope 생성
databricks secrets create-scope my-secrets

# 2. Secret 저장
databricks secrets put-secret my-secrets db-password --string-value "SuperSecretP@ssw0rd!"

# 3. Secret 목록 조회
databricks secrets list-secrets my-secrets

# 노트북에서 Secret 사용
db_password = dbutils.secrets.get(scope="my-secrets", key="db-password")

# JDBC 연결에서 사용
jdbc_url = f"jdbc:postgresql://host:5432/mydb?user=admin&password={db_password}"
df = spark.read.format("jdbc").option("url", jdbc_url).load()

# 특정 그룹에게 Secret 읽기 권한 부여
databricks secrets put-acl my-secrets data-engineers READ

# 접근 제어 목록 확인
databricks secrets list-acls my-secrets

# 토큰 생성 (CLI)
databricks tokens create --lifetime-seconds 7776000 --comment "CI/CD pipeline"

# 토큰 목록 조회
databricks tokens list

# Service Principal 생성 (Account 수준)
databricks account service-principals create \
  --display-name "etl-pipeline-sp" \
  --active true

# Service Principal에 OAuth Secret 생성
databricks service-principals create-oauth2-secret <sp-id>

-- 최근 24시간 내 로그인 실패 이벤트 조회
SELECT
    event_time,
    user_identity.email AS user_email,
    source_ip_address,
    service_name,
    action_name,
    response.status_code
FROM system.access.audit
WHERE action_name = 'login'
  AND response.status_code != 200
  AND event_time > CURRENT_TIMESTAMP() - INTERVAL 24 HOURS
ORDER BY event_time DESC;

-- 민감한 테이블에 대한 접근 이력 조회
SELECT
    event_time,
    user_identity.email AS user_email,
    action_name,
    request_params.full_name_arg AS table_name,
    source_ip_address
FROM system.access.audit
WHERE request_params.full_name_arg LIKE '%pii%'
  AND action_name IN ('getTable', 'commandSubmit')
  AND event_time > CURRENT_TIMESTAMP() - INTERVAL 7 DAYS
ORDER BY event_time DESC;

-- 권한 변경 이력 추적
SELECT
    event_time,
    user_identity.email AS changed_by,
    action_name,
    request_params
FROM system.access.audit
WHERE action_name IN ('updatePermissions', 'grantPermission', 'revokePermission')
  AND event_time > CURRENT_TIMESTAMP() - INTERVAL 30 DAYS
ORDER BY event_time DESC;