# Sharing data with specific users and roles > Grant read access to users or roles for multi-tenant applications and collaboration. MotherDuck lets you securely share data with specific users or roles. Common scenarios include: - Building data applications, in which each tenant should only have access to their own data. - Sharing sensitive data within your Organization. - Sharing data outside of your Organization. :::note Shares are **region-scoped** based on your Organization's cloud region. Each MotherDuck Organization is scoped to a single cloud region that must be chosen at Org creation when signing up. MotherDuck is available on AWS in six regions: - **US East (N. Virginia):** `us-east-1` - **US West (Oregon):** `us-west-2` - **Europe (Frankfurt):** `eu-central-1` - **Europe (Dublin):** `eu-west-1` - **Asia Pacific (Tokyo):** `ap-northeast-1` - **Asia Pacific (Sydney):** `ap-southeast-2` ::: MotherDuck supports two approaches: - Creating a Share with **Restricted** access, then granting READ to specified users or roles. - Creating a **Hidden** share and providing individuals with the share URL. ## Creating a Share with restricted access **Overview** 1. **Data provider** creates a share with **Restricted** access. 2. **Data provider** _(Share owner)_ grants READ to the **data consumers** directly or through a role. 3. **Data consumer** **attaches** the share. 4. **Data provider** periodically updates the share to push new data to **data consumers**. A user who has no direct grant and belongs to no role with a grant cannot access the Share, even with the Share link. ### UI Click on the "trident" next to the database you'd like to share. Select "Share". ![trident](useBaseUrl('/img/key-tasks/sharing-data/share_acl_ui.png')) 1. Optionally name the share. 2. Under "Who has access," choose the restricted option. Search for and add the users or roles that should have READ access. 3. Choose whether the share should be [automatically updated or not](../sharing-overview/#updating-shared-data). Default is `MANUAL`. 3. Create the share. 4. For the specified users, the share will appear in their UI under 'Shared with me' and can be attached. ### SQL ```sql use birds; CREATE SHARE birds FROM birds (ACCESS RESTRICTED); GRANT READ ON SHARE birds TO USER duck1, USER duck2; GRANT READ ON SHARE birds TO ROLE explorer; ``` **Data consumer** must `ATTACH` the restricted share before querying the share. See [consuming restricted shares](./#consuming-restricted-shares). :::note Restricted shares default to **Discoverable** visibility for users who have been granted access to the share. (Learn more about ["Discoverable shares"](../sharing-overview/#discoverable-shares)). ::: ### Consuming restricted shares The **data consumers** in your Organization with access to the restricted share can use the UI or SQL to **attach** the share and start querying it. ### UI 1. Select the restricted share you want to attach under "Shared with me" 2. Click "attach" and optionally name the resulting database. 3. You can query the resulting database. ### SQL Run the `ATTACH` command to attach the share as a queryable database. This is a zero-cost metadata-only operation. ```sql ATTACH md:_share/birds/e9ads7-dfr32-41b4-a230-bsadgfdg32tfa; -- Creates a zero-copy clone database called birds ``` Learn more about [ATTACH](/sql-reference/motherduck-sql-reference/attach.md). ### Modifying share access **Data providers** _(Share owners)_ can modify which users or roles have access to the Share. ### UI 1. Find the target share in the "Shares I've created" section of the Object Explorer, and choose the 'Alter' option from the context menu. 2. From here, you can add and remove users or roles with access to the Share. 3. You may also alter the share to use a different **access** scope. Learn more about [share access scopes](../sharing-overview/#organization-shares). For more details on how to configure access controls for restricted shares, see the [`GRANT READ ON SHARE` reference page](/sql-reference/motherduck-sql-reference/grant-access/). ### SQL ```sql GRANT READ ON SHARE birds TO USER duck3; REVOKE READ ON SHARE birds FROM USER penguin; ``` For more details on configuring access controls for restricted shares, see the [`GRANT READ ON SHARE` reference page](/sql-reference/motherduck-sql-reference/grant-access/). ## Creating hidden shares **Overview** 1. **Data provider** creates the share URL and passes this URL to the **data consumer**. 2. **Data consumer** **attaches** the share. 3. **Data provider** periodically updates the share to push new data to **data consumers**. To share a database, first create a Hidden share. No actual data is copied and no additional costs are incurred in this process. ### UI Click on the "trident" next to the database you'd like to share. Select "share". ![trident](useBaseUrl('/img/key-tasks/sharing-data/ui-share3.png')) 1. Optionally name the share. 2. To share the data with MotherDuck users inside or outside of your Organization, choose the "Anyone with the share link" option. This will enable anyone with the share link in the same cloud region to attach and query the share, including users outside your Organization. 3. Create the share. 4. Copy the resulting **ATTACH** command to your clipboard and send it to your **data consumers**. ### SQL ```sql use birds; CREATE SHARE birds FROM birds (ACCESS UNRESTRICTED , VISIBILITY HIDDEN); -- This query creates a Hidden share accessible by anyone with the share link in the same cloud region, including users outside your Organization > md:_share/birds/e9ads7-dfr32-41b4-a230-bsadgfdg32tfa ``` Save the returned share URL and pass it to **data consumers**. ### Consuming hidden shares The **data consumer** in your Organization can use SQL to attach the share and start querying it! ### SQL Run the `ATTACH` command to attach the share as a queryable database. This is a zero-cost metadata-only operation. ```sql ATTACH md:_share/birds/e9ads7-dfr32-41b4-a230-bsadgfdg32tfa; -- Creates a zero-copy clone database called birds ``` Learn more about [ATTACH](/sql-reference/motherduck-sql-reference/attach.md). ## Updating shared data If during creation of the share, the **data provider** chose to have the share updated automatically, the share will be updated periodically. If the share was created with `MANUAL` updates, the **data provider** needs to manually update the share. ```sql UPDATE SHARE birds; ``` Learn more about [UPDATE SHARE](/sql-reference/motherduck-sql-reference/update-share.md) and [data replication timing and checkpoints](./updating-shares.md). --- ## Docs feedback MotherDuck accepts optional user-submitted feedback about this page at `GET https://motherduck.com/docs/api/feedback/agent`. For agents and automated tools, feedback submission should be user-confirmed before sending. URL-encode query parameter values and send a GET request: ```text GET https://motherduck.com/docs/api/feedback/agent?page_path=%2Fkey-tasks%2Fsharing-data%2Fsharing-with-users%2F&page_title=Sharing%20data%20with%20specific%20users%20and%20roles&text= ``` Optionally append `&source=` such as `claude.ai` or `chatgpt`. `page_path` and `text` are required; `page_title` and `source` are optional. Responses: `200 {"feedback_id": ""}`, `400` for malformed query parameters, and `429` when rate-limited.