Controlled access provision for data exploration in managed compute datasets

1 . A computing system comprising:

a processor; and

a memory storing instructions that are operative upon execution by the processor to:

create a workspace including a compute cluster for a user, the user having permissions to the workspace; and

provision the compute cluster within a cloud computing infrastructure, the compute cluster including a code analyzer, the code analyzer being configured to:

receive a data query from a task executing on the compute cluster;

identify a query operation included in the data query;

compare the query operation to a list of prohibited query operations for the workspace to which the user has the permissions; and

terminate the data query without execution when the query operation is in the list of prohibited query operations for the workspace to which the user has the permissions.

2 . The computing system of claim 1 , wherein the list of prohibited query operations for the workspace is implemented as a just-in-time (JIT) access control feature that enforces the list of prohibited query operations for the user during a time period and excludes all query operations for the user outside of that time period by default.

3 . The computing system of claim 1 , wherein the query operation is for a first database in the workspace, the code analyzer being further configured to:

identify another query operation included in another data query from the task; and

allow the other data query operation when the other data query operation is for a second database outside the workspace.

4 . The computing system of claim 1 , wherein the code analyzer is further configured to:

identify another query operation included in another data query from the task; and

allow the other data query operation through a just-in-time access feature that enforces the list of prohibited query operations for an external user during a predetermined time period and excludes all query operations for the external user outside of that predetermined time period by default, wherein the external user is from an entity external to the workspace.

5 . The computing system of claim 1 , wherein the instructions are further operative upon execution by the processor to:

receive a list of users to be provided the permissions to the workspace; and

grant access to the workspace to the list of users though a just-in-time access feature that controls access to the workspace for a predetermined time period and automatically expires that granted access after the predetermined time period has elapsed.

6 . The computing system of claim 1 , wherein the instructions are further operative upon execution by the processor to:

receive, via a user interface, a request for creating the workspace on the compute cluster for the user.

7 . The computing system of claim 1 , wherein the instructions are further operative upon execution by the processor to:

log data queries from the task executing on the compute cluster;

train the code analyzer based on the logged data queries; and

automatically update, using the trained code analyzer, the list of prohibited query operations for the workspace.

8 . A method comprising:

creating a workspace on a compute cluster for a user, the user having permissions to the workspace; and

provisioning the compute cluster within a cloud computing infrastructure, the compute cluster including a code analyzer, the code analyzer being configured to:

receive a data query from a task executing on the compute cluster;

identify a query operation included in the data query;

compare the query operation to a list of prohibited query operations for the workspace to which the user has the permissions; and

terminate the data query without execution when the query operation is in the list of prohibited query operations for the workspace to which the user has the permissions.

9 . The method of claim 8 , wherein the list of prohibited query operations for the workspace is implemented as a just-in-time (JIT) access control feature that enforces the list of prohibited query operations for the user during a predetermined time period and excludes all query operations for the user outside of that predetermined time period by default.

10 . The method of claim 8 , wherein the query operation is for a first database in the workspace, the code analyzer being further configured to:

identify another query operation included in another data query from the task; and

allow the other data query operation when the other data query operation is for a second database outside the workspace.

11 . The method of claim 10 , wherein the code analyzer is further configured to:

identify another query operation included in another data query from the task; and

allow the other data query operation through a just-in-time access feature that enforces the list of prohibited query operations for an external user during a predetermined time period and excludes all query operations for the external user outside of that predetermined time period by default, wherein the external user is from an entity external to the workspace.

12 . The method of claim 8 , further comprising:

receiving a list of users to be provided the permissions to the workspace; and

granting access to the workspace to the list of users though a just-in-time access feature that controls access to the workspace for a predetermined time period and automatically expires that granted access after the predetermined time period has elapsed.

13 . The method of claim 8 , further comprising: receiving, via a user interface, a request for creating the workspace on the compute cluster for the user.

14 . The method of claim 8 , further comprising:

logging data queries from the task executing on the compute cluster;

training the code analyzer based on the logged data queries; and

automatically updating, using the trained code analyzer, the list of prohibited query operations for the workspace.

15 . A non-transitory computer-readable medium storing instructions that are operative upon execution by a processor to:

create a workspace including a compute cluster for a user, the user having permissions to the workspace; and

provision the compute cluster within a cloud computing infrastructure, the compute cluster including a code analyzer, the code analyzer being configured to:

receive a data query from a task executing on the compute cluster;

identify a query operation included in the data query;

compare the query operation to a list of allowed query operations for the workspace to which the user has the permissions; and

terminate the data query without execution when the query operation is not in the list of allowed query operations for the workspace to which the user has the permissions.

16 . The computer-readable medium of claim 1 , wherein the list of prohibited query operations for the workspace is implemented as a just-in-time (JIT) access control feature that enforces the list of prohibited query operations for the user during a predetermined time period and excludes all query operations for the user outside of that predetermined time period by default.

17 . The computer-readable medium of claim 1 , wherein the query operation is for a first database in the workspace, the code analyzer being further configured to:

identify another query operation included in another data query from the task; and

allow the other data query operation when the other data query operation is for a second database outside the workspace.

18 . The computer-readable medium of claim 1 , wherein the code analyzer is further configured to:

identify another query operation included in another data query from the task; and

allow the other data query operation through a just-in-time access feature that enforces the list of prohibited query operations for an external user during a predetermined time period and excludes all query operations for the external user outside of that predetermined time period by default, wherein the external user is from an entity external to the workspace.

19 . The computer-readable medium of claim 15 , wherein the instructions are further operative upon execution by the processor to:

receive a list of users to be provided the permissions to the workspace; and

grant access to the workspace to the list of users though a just-in-time access feature that controls access to the workspace for a predetermined time period and automatically expires that granted access after the predetermined time period has elapsed.

20 . The computer-readable medium of claim 1 , wherein the instructions are further operative upon execution by the processor to:

log data queries from the task executing on the compute cluster;

train the code analyzer based on the logged data queries; and

automatically update, using the trained code analyzer, the list of allowed query operations for the workspace.