About Associating Connections with Projects in Dataiku

Tosihiro

Hi,

In Dataiku, connection settings can be linked to user groups, but I believe they cannot be linked to projects. I have a question regarding this:

If UserA belongs to both the Finance and HR user groups, UserA would have access to connections associated with both of these groups. This situation can easily lead to unintended data mishandling. For example, when UserA is working on a recipe handling HR data, it is quite possible to mistakenly set the output connection to one linked to Finance. This could result in unintentional data accidents.

I believe that associating projects with specific connection settings in Dataiku, so that only certain connections are listed for a particular project, would be the most effective way to prevent this. However, currently, this is not possible in Dataiku.

I think this is a relatively common use case. Could you please advise on the standard configuration in Dataiku to handle data more safely?

P.S.: I have referred to the following community answers, but I do not believe I have received a satisfactory solution:

https://community.dataiku.com/discussion/12721/forcing-a-connection-s-on-project

https://community.dataiku.com/discussion/23797/preventing-users-from-accessing-managed-datasets-as-input

Tsuyoshi

Hi @Tosihiro, perhaps you can use a 'Connections/Projects restrictions plugin'. Though, there are some caveats, please consider the following points and decide whether to use it or not.

• The plugin is not officially supported (Tier 2 support)
• Once the “Explicit mode” is enabled, all the connections are prohibited unless the projects are specified in the "allowed list" of each connection.

It looks like the document link in the plugin details does not work, so please refer to this link.

Tosihiro

Hi @Tsuyoshi ,

Thank you for providing the solution. I greatly appreciate your support and will try it out immediately.

Best regards,

Turribeach

I wasn't aware of this plugin and it is pretty cool that this can be supported in such way but in my view this makes the Administration of the security model a bigger overhead. Since the original poster is trying to prevent "unintended data mishandling" my approach would be to monitor projects using the Dataiku Python API which can easily detect which connections are being used in each project.