Individual skill
managing-data-asset-access
Grants, requests, audits and removes access to data assets in an AWS data catalog (the Amazon SageMaker Catalog supported by Amazon DataZone) through catalog subscriptions over published listings. Covers requesting a subscription, approving or rejecting requests with a recorded decision, sharing a listing with a project, revoking one or many subscriptions, and confirming grant settlement. Triggers on: give another team access to a table, request access to a dataset, approve or reject an access request, share a listing with a project, who has access to this table, revoke access, bulk revoke, is the access actually gone, subscription grant status. Not for: IAM roles, policies or STS (use aws-iam), S3 bucket policies (use securing-s3-buckets), Clean Rooms permissions (use aws-cleanrooms), or writing catalog metadata, glossaries and forms, publishing listings, or retiring or deleting an asset that other teams are subscribed to and the order of operations that needs (use managing-data-catalog)
plugins/aws-data-analytics/skills/managing-data-asset-access/SKILL.md
Source commit 1761e96813ebcbd43ed81d19e837219033f0afe5
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 3, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 3,429
- Repository last updated
- Nov 6, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- operations Derived category
- writing Derived category
- data Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 16,145 bytesSKILL.mdcore · 16,145 bytesSKILL.mdcore · 16,145 bytesreferences/access-model-detection.mddoc · 7,816 bytesreferences/access-safety.mddoc · 9,482 bytesreferences/approving-access.mddoc · 10,651 bytesreferences/auditing-and-revoking.mddoc · 15,553 bytesreferences/bulk-revocation.mddoc · 2,929 bytesreferences/requesting-access.mddoc · 5,614 bytesreferences/troubleshooting.mddoc · 6,355 bytes
Read excerpt
# Manage Data Asset Access
Access to a catalog data asset is a **subscription over a published listing**.
Request it, decide on it, share it, audit it, remove it. And prove each of
those actually took effect.
## Overview
You SHOULD execute commands through AWS MCP server tools when connected: they
give validation, sandboxed execution and audit logging, which matter more than
usual in a skill whose failures are security misstatements. Fall back to the AWS
CLI when the MCP server is unavailable; every step here is expressed as CLI
calls, so it runs either way. You MUST explain each grant or revoke before
executing it, and you MUST report what you verified afterwards.