Skip to content

Integrating SailPoint with Starburst

Starburst is a fully managed cloud analytics and data-lakehouse platform built on Trino. It enables organizations to query and govern data distributed across object storage, cloud data warehouses, relational databases, and other connected data sources. A Starburst Galaxy account represents the managed environment in which administrators configure users, roles, clusters, catalogs, access controls, and security policies. People who sign in to the Starburst Galaxy account are treated as accounts by this connector. Each user is identified by a unique Starburst user ID and email address. Access is controlled through roles such as accountadmin, public, and customer-defined roles. Users can receive roles directly or inherit them through Starburst's role hierarchy. This document covers how to configure a new direct connection between SailPoint and Starburst for Quick Compliance. For a reference to the terminology specific to SailPoint products, refer to Source and Connector Definitions.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The Starburst connector supports the following:

Account Management

  • Aggregate Users

Entitlement Management

  • Aggregate Roles

Non-Human Identity Discovery

  • Aggregate Service Accounts
  • Aggregate Cross-Account IAM Roles
  • Aggregate SQL Jobs

Note

Service accounts, cross-account IAM roles, and SQL jobs are aggregated as non-human identity resources through Dataset Management. They are separate from human user account aggregation. These resources do not define owner correlation.

Note

This connector is read-only. It supports test connection, account aggregation, entitlement aggregation, and dataset aggregation for Quick Compliance. Provisioning, de-provisioning, and write operations are not supported.

Important

Quick Compliance connectors have the following manual aggregation limits within a 24-hour period:

  • Organization Admins: Limited to 3 manual account or entitlement aggregations per day per source. This limit is cumulative across all admins in the organization.
  • Regular Users: Limited to 1 manual account or entitlement aggregation per day per source.

These limits ensure that individual compliance statuses are kept up to date while maintaining continuous compliance monitoring. If you need to run additional aggregations beyond these limits, contact SailPoint Support.

Prerequisites

Before you configure the Starburst connector, ensure the following requirements are met:

  1. Sign in to Starburst.
  2. Go to Access > API Auth Tokens.
  3. Select Generate New Token.
  4. Enter a meaningful description for the token, and assign an appropriate role to the token.
  5. Create the token, then securely copy its Client ID and Secret key.
  6. Build the Base64-encoded value of clientId:secretKey. Store only the resulting encoded value in the connector credential field as API Token.

  7. Record the following values for connector configuration:

    • Base URL - For example, https://<account-domain>.galaxy.starburst.io.
    • API Token - The Base64-encoded clientId:secretKey value.

For more information, refer to the Starburst Galaxy API documentation.

Note

The linked document is not maintained by SailPoint and is subject to change without notice.

Required Permissions

The role assigned to the API auth token must be able to read users, roles, service accounts, cross-account IAM roles, and SQL jobs. A token assigned accountadmin can call every Galaxy API endpoint. With a valid token, the connector can:

  • List users, including their direct and inherited roles
  • List roles, including direct grants and inherited grants
  • List service accounts, including their roles and password metadata
  • List cross-account IAM roles configured on the account
  • List SQL jobs and their schedules