Databricks Connection Overview
ALTR connects to Databricks through a service principal and Unity Catalog APIs — there is no agent, sidecar, or other customer-hosted component to install.
To set up the service principal and workspace prerequisites this connection depends on, see Connecting Your Databricks Account to ALTR.
Service Principal and API
Section titled “Service Principal and API”The service principal is a login to your Databricks account that lets ALTR create and manage the objects that enforce tag-based masking. ALTR reaches your workspace through Unity Catalog APIs to deploy and maintain those objects.
Because Databricks masking policies run entirely within Unity Catalog, there is no query-time callback to ALTR’s cloud — ALTR writes tag-based masking policies directly into Unity Catalog. This pushdown-only model is why tokenization and Format-Preserving Encryption (FPE) are not available on Databricks: both require a query-time call to ALTR’s cloud, for detokenization or key retrieval, that Databricks masking policies cannot make. Contact ALTR support about tokenization or FPE on Databricks.
Requirements
Section titled “Requirements”ALTR supports Databricks Premium Tier on AWS with Unity Catalog enabled and a Metastore-level managed storage location. ALTR connects using a service principal that has been added to the Metastore admins group.
For the full account setup — creating the service principal, the required group, and the workspace cluster ALTR uses — see Preparing Your Databricks Account.
Tag-Based Masking
Section titled “Tag-Based Masking”ALTR enforces masking on Databricks through tag-based policy only. After connecting, ALTR deploys native column masks directly to the columns carrying a matching tag, and Databricks applies the mask at query time.
Databricks supports a subset of ALTR’s masking types. For the masking mechanism, matching rules, and how overlapping policies resolve, see Data Masking on Databricks.
Classification
Section titled “Classification”ALTR classifies Databricks data using ALTR Native and Google DLP. For classifier rule types and how classification jobs work, see Data Classification.