---
title: Set up OpenSharing for your account (for providers) | Databricks on AWS
source: https://docs.databricks.com/aws/en/delta-sharing/set-up
ingestedAt: "2026-06-18T08:05:50.248Z"
---

This page describes how to setup OpenSharing on Databricks for data providers (organizations that want to use OpenSharing to share data securely).

If you are a _data recipient_ (an organization that receives data that is shared using OpenSharing), see [Read data shared using Databricks-to-Databricks OpenSharing (for recipients)](https://docs.databricks.com/aws/en/delta-sharing/read-data-databricks).

important

OpenSharing requires a Unity Catalog\-enabled workspace. You can create one Unity Catalog\-enabled workspace for share management. In some accounts, new workspaces are enabled for Unity Catalog automatically. See [Get started with Unity Catalog](https://docs.databricks.com/aws/en/data-governance/unity-catalog/get-started).

If creating a new Unity Catalog\-enabled workspace is not an option, you can use the [open-source OpenSharing project](https://opensharing.io/) to deploy your own OpenSharing server to share Delta tables from any platform.

Initial provider setup includes the following steps:

1.  Enable OpenSharing on a Unity Catalog metastore.
2.  (Optional) Install the Unity Catalog CLI.
3.  Grant privileges to create and manager shares and recipients.
4.  Configure time-to-live (TTL) of data materialization.
5.  Configure storage network access.

## Requirements[​](#requirements "Direct link to Requirements")

As a data provider who is setting up your Databricks account to be able to share data, you must have:

*   At least one Databricks workspace that is [enabled for Unity Catalog](https://docs.databricks.com/aws/en/data-governance/unity-catalog/get-started).
    
    You do not need to migrate all of your workspaces to Unity Catalog to take advantage of Databricks support for OpenSharing providers. See [Do I need Unity Catalog to use OpenSharing?](https://docs.databricks.com/aws/en/delta-sharing/#uc-faq).
    
    Recipients do not need to have a Unity Catalog\-enabled workspace.
    
*   Account admin role to enable OpenSharing for your Unity Catalog metastore.
    
*   Metastore admin role or the `CREATE SHARE` and `CREATE RECIPIENT` privileges. See [Metastore admins](https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/admin-privileges#metastore-admins).
    
*   A cloud storage configuration that allows network access from the recipient.
    

You do not need to enable OpenSharing on your metastore if you intend to use OpenSharing only to share data with users on other Unity Catalog metastores in your account. Metastore-to-metastore sharing within a single Databricks account is enabled by default.

Otherwise, follow these steps for each Unity Catalog metastore that manages data that you plan to share using OpenSharing.

1.  As a Databricks account admin, log in to the [account console](https://accounts.cloud.databricks.com/).
    
2.  In the sidebar, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
    
3.  Click the name of a metastore to open its details.
    
4.  Click the checkbox next to **Allow OpenSharing with parties outside your organization**.
    
5.  Configure the recipient token lifetime.
    
    This configuration sets the period of time after which all recipient tokens expire and must be regenerated. Recipient tokens are used only in the [Databricks-to-Open sharing](https://docs.databricks.com/aws/en/delta-sharing/#open) protocol. Tokens are valid for a maximum of one year after creation.
    
    note
    
    The recipient token lifetime for existing recipients is not updated automatically when you change the default recipient token lifetime for a metastore. In order to apply a new token lifetime to a given recipient, you must rotate their token. See [Manage recipient tokens](https://docs.databricks.com/aws/en/delta-sharing/create-recipient-token#rotate-credential).
    
    To set the default recipient token lifetime:
    
    1.  Confirm that **Set expiration** is enabled (this is the default).
    2.  Enter a number of seconds, minutes, hours, or days, and select the unit of measure. Tokens are valid for a maximum of one year after creation.
    3.  Click **Enable**.
    
    For more information, see [Security considerations for tokens](https://docs.databricks.com/aws/en/delta-sharing/create-recipient-token#security-considerations).
    
6.  When sharing with a Databricks recipient who is not in your account, enter an **Organization name**.
    
    note
    
    Specifying a readable organization name helps recipients to identify their share providers and the corresponding provider objects in the recipient's provider list.
    
7.  Click **Enable**.
    

## (Optional) Install the Unity Catalog CLI[​](#optional-install-the-unity-catalog-cli "Direct link to optional-install-the-unity-catalog-cli")

To manage shares and recipients, you can use Catalog Explorer, SQL commands, or the Unity Catalog CLI. The CLI runs in your local environment and does not require Databricks compute resources.

To install the CLI, see [Databricks CLI](https://docs.databricks.com/aws/en/dev-tools/cli/).

Metastore admins have the ability to create and manage shares and recipients, including the granting of shares to recipients. Many provider tasks can be delegated by a metastore admin using the following privileges:

*   `CREATE SHARE` on the metastore grants the ability to create shares.
*   `CREATE RECIPIENT` on the metastore grants the ability to create recipients.
*   `USE RECIPIENT` on grants the ability to list and view details for all recipients in the metastore.
*   `USE SHARE` on the metastore grants the ability to list and view details for all shares in the metastore.
*   `USE RECIPIENT`, `USE SHARE,` and `SET SHARE PERMISSION` combined give a user the ability to grant share access to recipients.
*   The metastore admin has the ability to transfer ownership of any share.
*   Share and recipient owners can update those objects and grant shares to recipients. Object creators are granted ownership by default, but ownership can be transferred.
*   Share owners can add tables and volumes to shares, as long as they have `SELECT` access to the tables and `READ VOLUME` access to the volumes.

For details, see [Unity Catalog privileges reference](https://docs.databricks.com/aws/en/data-governance/unity-catalog/access-control/privileges-reference) and the permissions listed for the OpenSharing tasks described.

## Configure TTL of data materialization[​](#configure-ttl-of-data-materialization "Direct link to configure-ttl-of-data-materialization")

As a Databricks account or metastore admin, you can configure the TTL of data materialization, which determines how long a materialized result is cached. Materializations occur when a recipient queries shared dynamic views, materialized views, streaming tables, and foreign tables. By default, the TTL is eight hours. The cache itself will be evicted by materialization after an additional three hours, providing extra time for existing queries to finish.

To change this value, do the following:

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog** to open Catalog Explorer.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  On the **Shared with me** tab, click your organization name in the upper-right corner.
    
4.  Click the top right ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon.
    
5.  For **Materialization TTL**, enter your desired TTL value.
    

## Allow network access to storage[​](#allow-network-access-to-storage "Direct link to Allow network access to storage")

If your underlying cloud storage is configured with access controls, add your recipient's network to the allowlist so they can read shared tables.

tip

Instead of manually configuring networking and firewall rules for each recipient, use [SecureConnect](https://docs.databricks.com/aws/en/delta-sharing/secureconnect-provider) to broker access through a managed proxy.

For details, see [Bucket policies for Amazon S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html) and [Serverless compute firewall configuration](https://docs.databricks.com/aws/en/security/network/serverless-network-security/serverless-firewall-config).

## Next steps[​](#next-steps "Direct link to Next steps")

*   Create [a share](https://docs.databricks.com/aws/en/delta-sharing/create-share)
*   Share [data using Databricks-to-Databricks sharing](https://docs.databricks.com/aws/en/delta-sharing/share-data-databricks)
*   Share [data using the Databricks-to-Open sharing protocol](https://docs.databricks.com/aws/en/delta-sharing/share-data-open)
*   Audit [Audit and monitor data sharing](https://docs.databricks.com/aws/en/delta-sharing/audit-logs)
