Databricks on AWS: How One Team Isolated Prod, Dev, and Sandbox Using Unity Catalog

A data engineering team building a Databricks AI platform on AWS designed a three-zone architecture using Unity Catalog to strictly separate production, development, and analyst sandbox environments. The core principle is that no human account holds write access to production data; all create, update, and delete operations run exclusively through automated, code-reviewed pipelines executed by a service principal. Analysts access production data in place via Unity Catalog permissions or Delta Sharing, eliminating the need for costly and potentially stale data copies. A dedicated sandbox catalog gives analysts free write access to materialize intermediate query results without any risk of affecting production. The Medallion architecture — moving data through raw, cleaned, integrated, and business layers — underpins all three zones and governs how data is promoted across environments.