Encrypted ducklake with multiple users

[dwinkler1]

I’m trying to understand the workflow for encrypted ducklakes. We have sensitive data we can only store encrypted. My understanding is that each Parquet file in an encrypted ducklake gets its own key which is stored in the catalog file. Can there be only one shared catalog file that needs to be shared with all users or is there something like encrypting with multiple users public keys? Any experiences with that?

[Alex-Monahan]

Howdy! Would using row level security within your metadata database work for your use case? Individual users could only have access to the keys of the tables they were granted the ability to read.

[dwinkler1]

Hey! Thank you that would work perfectly. Is there a guide on how to implement that? Can that be authenticated with private public key pairs?

[Alex-Monahan]

Unfortunately I do not have those answers at the moment! Those are somewhat postgres-specific questions, so I would see if Postgres can authenticate your users in the manner that you would like! Then you should be able to pass those parameters into the Postgres connection that DuckLake uses.

[dwinkler1]

I was hoping to get away with a duckdb only deployment but looks like it's going to be more complicated. Thank you!