# Securing and Managing Multi-cloud Presto Clusters with Grab’s DataGateway

[Grab](https://yomu.fyi/company/grab) · Vinnson Lee · Aug 24, 2020

**Type:** Problem & solution

## Summary

Grab's data engineering team needed to manage data access across growing Presto workloads spanning hundreds of users, thousands of tables, and multiple clouds without exposing infrastructure churn to clients. Out-of-the-box Presto lacked fine-grained schema- and table-level access controls, unified endpoint routing, and seamless cluster switching. To solve this, the team built DataGateway, a smart HTTP proxy and abstraction layer deployed as microservices on Kubernetes. The platform parses incoming SQL statements, verifies user access control lists against target schemas and tables, and dynamically routes queries to appropriate AWS or Azure Presto clusters without requiring endpoint updates. This architecture enabled zero-disruption cluster migrations across 40 clusters and unified access management across a multi-cloud data lake environment.

## Context

Grab needed a single endpoint to serve hundreds of Presto users, enforce schema-, table-, and column-level access control beyond basic cloud IAM storage controls, capture audit trails, and maintain seamless user experiences during cluster provisioning, upgrades, and multi-cloud expansions across AWS and Azure.

## Approach / What changed

Grab built DataGateway as a Kubernetes-hosted microservices platform comprising an API Service that mimics the Presto API, a version-matched SQL Parser to extract requested schemas and tables, an Auth Framework handling modular authentication and ACL checks, and an Admin UI for access and cluster management.

## Takeaways

- AWS IAM roles on EMR/EKS provide only bucket- and file-level S3 control, making application-level SQL statement parsing necessary for schema-, table-, and field-level permissions.
- DataGateway compiles separate SQL parser engines to match each distinct running version of Presto because SQL parsing behaviors vary across releases.
- Using DataGateway as a proxy allowed Grab to migrate 40 Presto clusters on AWS EMR and route queries between AWS and Azure dynamically without requiring end users to change connection endpoints.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [AWS](https://yomu.fyi/topic/aws), [Azure](https://yomu.fyi/topic/azure), [Kubernetes](https://yomu.fyi/topic/kubernetes)

[Read original post](https://engineering.grab.com/data-gateway)