Looker is a versatile data analytics platform that allows businesses to gain meaningful insights from their data. However, not every piece of information is relevant for all users, and some data might be confidential or sensitive. Hence, managing access to data becomes crucial. Looker provides a feature known as role-based access control (RBAC), which allows administrators to control who can see and do what within the Looker platform. This article will guide you through implementing role-based access control in Looker.
Understanding Looker Permissions
At the core of Looker's RBAC are permissions. These are specific abilities that you can grant to user roles. Examples of permissions include 'see_lookml', 'see_user_dashboards', 'create_table_calculations', etc.
Users can't have permissions directly assigned to them; instead, permissions are assigned to roles, and roles are then assigned to users or groups. This layer of abstraction allows for a flexible and easily maintainable access control structure.
Creating and Managing Roles
To create a role, navigate to the Admin panel, then select 'Roles' from the sidebar. Click 'Create Role' and name your role according to its responsibilities or the user group it corresponds to, like 'Data Analyst', 'Marketing', etc.
Once you've created a role, you can start assigning permissions to it. This is done from the same 'Roles' page. Click on a role to edit it, then select the permissions you want this role to have. Click 'Update Role' when you're done.
Assigning Roles to Users and Groups
Now that you've defined some roles, you can start assigning them to users and groups. You can assign roles to individual users from the 'Users' page in the Admin panel. Click on a user to edit them, then select 'Add Roles' to add one or more roles to this user.
Alternatively, you can create groups of users and assign roles to the whole group. This is particularly useful if you have a lot of users, as it saves you from having to assign roles to each user individually. Navigate to the 'Groups' page in the Admin panel to create groups and assign roles.
Managing Model Access
In Looker, the term 'model' refers to a LookML model, which is a project file that defines the connections between database tables and the visualizations in Looker. You can control which roles have access to which models.
This is done in the LookML model file itself, using the 'access_grant' parameter. For example:
access_grant: {
name: finance
user_attribute: department
allowed_values: ["Finance", "Executive"]
}
In this example, only users whose 'department' attribute is either 'Finance' or 'Executive' can access the model. The 'department' attribute would typically be set by an administrator when creating or editing users.
Conclusion
Implementing role-based access control in Looker allows you to fine-tune who has access to what data and capabilities in your Looker platform. By carefully assigning permissions to roles, then assigning those roles to users or groups, you can ensure that each user only sees the data they need to see, without risking exposing sensitive information. Moreover, through the use of access grants, you can control the access to models on a finer level, based on the user attributes. RBAC is a powerful tool for managing access to your data, and it's a key part of maintaining the security and integrity of your Looker platform.