External secrets in Unity Catalog
External secrets in Unity Catalog is a Databricks data governance capability, introduced September 2026.
Unity Catalog schemas backed by a cloud secret manager, so the values stay in AWS Secrets Manager or Azure Key Vault and only appear in Unity Catalog as read-only securables governed by Unity Catalog privileges.
- Databricks never keeps the value: every single read goes back out to your cloud secret manager, so the latency and the cloud provider's per-call bill are part of the design rather than a bug.
- A secret manager that allows dots and slashes meets a catalog that does not, and the catalog wins - Unity Catalog quietly rewrites the characters it cannot support on import.
- Point it at more secrets than the schema's quota allows and nothing errors - Databricks imports the oldest ones by creation date until the quota is full and leaves the rest behind.
Limitations: Read-only from Databricks - CREATE SECRET, WRITE SECRET and deletes are rejected, so the secrets are managed in the external secret manager. A schema cannot mix Databricks-managed and externally backed secrets, switching a schema's backend drops the imported secrets along with their permissions and tags, cross-cloud backing is unsupported, listing is eventually consistent (a few minutes on large stores), and tag filtering applies only to AWS Secrets Manager connections. The Unity Catalog secret quotas still apply - 100 per schema and 1,000 per metastore by default, both raisable on request.
Open in REbricked →- Category
- Data governance
- Also known as
- External secrets, Externally backed secrets, AWS Secrets Manager in Unity Catalog
- Verified
- 2026-09-15