---
title: Allowlist libraries and init scripts on compute with standard access mode (formerly shared access mode) | Databricks on AWS
source: https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/allowlist
ingestedAt: "2026-06-18T08:04:45.741Z"
---

In Databricks Runtime 13.3 LTS and above, the `allowlist` in Unity Catalog controls which libraries and init scripts can run on standard access mode compute. This allows users to leverage these artifacts on compute configured with standard access mode.

By default, the allowlist is empty. You cannot disable this feature. To modify the allowlist, you must have the `MANAGE ALLOWLIST` privilege. See [MANAGE ALLOWLIST](https://docs.databricks.com/aws/en/data-governance/unity-catalog/access-control/privileges-reference#manage-allowlist).

You can add a directory or file to the allowlist even if it hasn't been created yet. See [Work with files in Unity Catalog volumes](https://docs.databricks.com/aws/en/volumes/volume-files).

important

Libraries used as JDBC drivers or custom Spark data sources on Unity Catalog\-enabled standard compute require `ANY FILE` permissions.

Some installed libraries store data of all users in one common temp directory. These libraries might compromise user isolation.

## Security and operational risks[​](#security-and-operational-risks "Direct link to Security and operational risks")

Understanding the security implications of allowlists is critical for maintaining cluster isolation and protecting your data on standard access mode compute. Proper allowlist usage prevents users from adding arbitrary libraries and init scripts. This reduces the likelihood of security issues, cluster instability, and other unpredictable behavior.

Be deliberate about who receives `MANAGE ALLOWLIST` privileges. Users with `MANAGE ALLOWLIST` privileges can allowlist any path or Maven coordinate, effectively controlling what code can run on standard access mode compute.

As the metastore admin, periodically review items on the allowlist and verify that they come from trusted sources. Allowlisted artifacts can access cluster resources and user data, so they should be subject to the same security and governance controls as other sensitive components.

Databricks recommends these best practices for managing the allowlist:

*   Grant the `MANAGE ALLOWLIST` privilege only to metastore admins and trusted platform administrators. For other users, grant `MANAGE ALLOWLIST` only on a temporary, as-needed basis.
*   Review and audit allowlist additions regularly.
*   Use specific paths and Maven coordinates rather than broad patterns.
*   Configure storage locations for allowlisted artifacts with read-only permissions.
*   Implement a formal approval process for allowlist additions in production environments.
*   Test allowlisted libraries and init scripts in non-production environments before adding them to production allowlists.

## How to add items to the allowlist[​](#how-to-add-items-to-the-allowlist "Direct link to How to add items to the allowlist")

You can add items to the `allowlist` with [Catalog Explorer](https://docs.databricks.com/aws/en/catalog-explorer/) or the [REST API](https://docs.databricks.com/api/workspace/artifactallowlists).

To open the dialog for adding items to the allowlist in Catalog Explorer, do the following:

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
2.  Click the gear icon ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]).
3.  Click the metastore name to open the metastore details and permissions UI.
4.  Select **Allowed JARs/Init Scripts**.
5.  Click **Add**.

important

This option only displays for users with the `MANAGE ALLOWLIST` privilege on the metastore. If you cannot access the allowlist UI, contact your [metastore admin](https://docs.databricks.com/aws/en/data-governance/unity-catalog/manage-privileges/admin-privileges#metastore-admins) for assistance in allowlisting libraries and init scripts.

## Add an init script to the allowlist[​](#add-an-init-script-to-the-allowlist "Direct link to add-an-init-script-to-the-allowlist")

Complete the following steps in the allowlist dialog to add an init script to the allowlist:

1.  For **Type**, select **Init Script**.
2.  For **Source Type**, select **Volume** or the object storage protocol.
3.  Specify the source path to add to the allowlist. See [How are permissions on paths enforced in the allowlist?](#paths).

## Add a JAR to the allowlist[​](#add-a-jar-to-the-allowlist "Direct link to Add a JAR to the allowlist")

Complete the following steps in the allowlist dialog to add a JAR to the allowlist:

1.  For **Type**, select **JAR**.
2.  For **Source Type**, select **Volume** or the object storage protocol.
3.  Specify the source path to add to the allowlist. See [How are permissions on paths enforced in the allowlist?](#paths).

## Add Maven coordinates to the allowlist[​](#add-maven-coordinates-to-the-allowlist "Direct link to add-maven-coordinates-to-the-allowlist")

important

Before adding Maven coordinates to the allowlist, you must have CAN ATTACH TO and CAN MANAGE permissions set on the compute where you want to install the library. See [Compute permissions](https://docs.databricks.com/aws/en/compute/clusters-manage#compute-permissions).

Complete the following steps in the allowlist dialog to add Maven coordinates to the allowlist:

1.  For **Type**, select **Maven**.
2.  For **Source Type**, select **Coordinates**.
3.  Enter coordinates in the following format: `groudId:artifactId:version`.
    *   You can include all versions of a library by allowlisting the following format: `groudId:artifactId`.
    *   You can include all artifacts in a group by allowlisting the following format: `groupId`.

## How are permissions on paths enforced in the allowlist?[​](#how-are-permissions-on-paths-enforced-in-the-allowlist "Direct link to how-are-permissions-on-paths-enforced-in-the-allowlist")

You can use the allowlist to grant access to JARs or init scripts stored in Unity Catalog volumes and object storage. If you add a path for a directory rather than a file, allowlist permissions propagate to contained files and directories.

Prefix matching is used for all artifacts stored in Unity Catalog volumes or object storage. To prevent prefix matching at a given directory level, include a trailing slash (`/`). For example, `/Volumes/prod-libraries/` will not perform prefix matching for files prefixed with `prod-libraries`. Instead, all files and directories within `/Volumes/prod-libraries/` are added to the allowlist.

You can define permissions at the following levels:

1.  The base path for the volume or storage container.
2.  A directory nested at any depth from the base path.
3.  A single file.

Adding a path to the allowlist only means that the path can be used for either init scripts or JAR installation. Databricks still checks for permissions to access data in the specified location.

The principal used must have `READ VOLUME` permissions on the specified volume. See [READ VOLUME](https://docs.databricks.com/aws/en/data-governance/unity-catalog/access-control/privileges-reference#read-volume).

In dedicated access mode (formerly single user access mode), the identity of the assigned principal (a user or group) is used.

In standard access mode:

*   Libraries use the identity of the library installer.
*   Init scripts use the identity of the cluster owner.

note

No-isolation shared access mode does not support volumes, but uses the same identity assignment as standard access mode.

Databricks recommends configuring all object storage privileges related to init scripts and libraries with read-only permissions. Users with write permissions on these locations can potentially modify code in library files or init scripts.

Databricks recommends using instance profiles to manage access to JARs or init scripts stored in S3. Use the following documentation in the cross-reference link to complete this setup:

1.  Create a IAM role with read and list permissions on your desired buckets. See [Tutorial: Configure S3 access with an instance profile](https://docs.databricks.com/aws/en/archive/storage/tutorial-s3-instance-profile).
2.  Launch a cluster with the instance profile. See [Instance profiles](https://docs.databricks.com/aws/en/compute/configure#instance-profiles).

note

Allowlist permissions for JARs and init scripts are managed separately. If you use the same location to store both types of objects, you must add the location to the allowlist for each.
