- PrivaceraCloud Release 7.4
- Enhancements and updates in PrivaceraCloud release 7.4
- Known Issues in PrivaceraCloud 7.4
- PrivaceraCloud User Guide
- Overview of PrivaceraCloud
- Connect applications with the setup wizard
- Connect applications
- About applications
- Connect Azure Data Lake Storage Gen 2 (ADLS) to PrivaceraCloud
- Connect Amazon Textract to PrivaceraCloud
- Athena
- Privacera Discovery with Cassandra
- Connect Databricks to PrivaceraCloud
- Databricks SQL
- Databricks SQL Overview and Configuration
- Planning and general process
- Prerequisites
- Databricks SQL with Privacera Hive
- Connect Databricks SQL application
- Grant Databricks SQL permissions to PrivaceraCloud users
- Define a resource policy
- Test the policy
- Databricks SQL PolicySync fields
- Configuring column-level access control
- View-based masking functions and row-level filtering
- Create an endpoint in Databricks SQL
- Databricks SQL Fields
- Databricks SQL Hive Service Definition
- Databricks SQL Masking Functions
- Databricks SQL Encryption
- Use a custom policy repository with Databricks
- Connect Databricks SQL to Hive policy repository on PrivaceraCloud
- Databricks SQL Overview and Configuration
- Connect Databricks Unity Catalog to PrivaceraCloud
- Connect S3 to PrivaceraCloud
- Prerequisites in AWS console
- Connect S3 application to PrivaceraCloud
- Enable Privacera Access Management for S3
- Enable Data Discovery for S3
- S3 AWS Commands - Ranger Permission Mapping
- S3
- AWS Access with IAM
- Access AWS S3 buckets from multiple AWS accounts
- Add UserInfo in S3 Requests sent via Dataserver
- Control access to S3 buckets with AWS Lambda function on PrivaceraCloud
- Dremio Plugin
- DynamoDB
- Connect Elastic MapReduce from Amazon application to PrivaceraCloud
- Connect EMR application
- EMR Spark access control types
- PrivaceraCloud configuration
- AWS IAM roles using CloudFormation setup
- Create a security configuration
- Create EMR cluster
- How to configure multiple JSON Web Tokens (JWTs) for EMR
- EMR Native Ranger Integration with PrivaceraCloud
- Connect EMRFS S3 to PrivaceraCloud
- Files
- GBQ
- Google Cloud Storage
- Connect Glue to PrivaceraCloud
- Google BigQuery for PolicySync
- Connect Kinesis to PrivaceraCloud
- Connect Lambda to PrivaceraCloud
- Microsoft SQL Server
- MySQL for Discovery
- Open Source Apache Spark
- Oracle for Discovery
- PostgreSQL
- Connect Power BI to PrivaceraCloud
- Presto
- Redshift
- Snowflake
- Starburst Enterprise with PrivaceraCloud
- Starburst Enterprise Presto
- Trino
- Connect users
- Data access Users, Groups, and Roles
- UserSync
- Portal user LDAP/AD
- Datasource
- Okta Setup for SAML-SSO
- Azure AD setup
- SCIM Server User-Provisioning
- User Management
- Identity
- Access Manager
- Access Manager
- Resource Policies
- Tag Policies
- Scheme Policies
- Service Explorer
- Reports
- Audit
- About data access users, groups, and roles resource policies
- Security zones
- Discovery
- Classifications via random sampling
- Privacera Discovery scan targets
- Propagate Privacera Discovery Tags to Ranger
- Enable offline scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Real-time Scanning of S3 Buckets
- Enable Real-time Scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Discovery Realtime Scanning Using IAM Role
- Encryption
- Overview of Privacera Encryption
- Encryption schemes
- Presentation schemes
- Masking schemes
- Create scheme policies
- Privacera-supplied encryption schemes for the Privacera API
- Privacera-supplied encryption schemes for the Bouncy Castle API
- API date input formats
- Deprecated encryption formats, algorithms, and scopes
- Privacera Encryption REST API
- PEG API endpoint
- PEG REST API encryption endpoints
- Prerequisites
- Common PEG REST API fields
- Construct the datalist for the /protect endpoint
- Deconstruct the response from the /unprotect endpoint
- Example data transformation with the /unprotect endpoint and presentation scheme
- Example PEG API endpoints
- Make encryption API calls on behalf of another user
- Privacera Encryption UDF for masking in Databricks on PrivaceraCloud
- Privacera Encryption UDFs for Trino on PrivaceraCloud
- Syntax of Privacera Encryption UDFs for Trino
- Prerequisites for installing Privacera Crypto plug-in for Trino
- Download and install Privacera Crypto jar
- Set variables in Trino etc/crypto.properties
- Restart Trino to register the Privacera encryption and masking UDFs for Trino
- Example queries to verify Privacera-supplied UDFs
- Privacera Encryption UDF for masking in Trino on PrivaceraCloud
- Encryption UDFs for Apache Spark on PrivaceraCloud
- Launch Pad
- Settings
- Dashboard
- Usage statistics
- Operational status of PrivaceraCloud and RSS feed
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- PrivaceraCloud Previews
- Preview: File Explorer for S3
- Preview: File Explorer for Azure
- Preview: File Explorer for GCS
- Preview: Scan Generic Records with NER Model
- Preview: Scan Electronic Health Records with NER Model
- Preview: OneLogin setup for SAML-SSO
- Preview: Azure Active Directory SCIM Server UserSync
- Preview: OneLogin UserSync
- Preview: PingFederate UserSync
- Quickstart for Databricks Unity Catalog on PrivaceraCloud
- What do I need to do in my Databricks Workspace?
- Where is the sample dataset in my Databricks Workspace?
- What should I do in the PrivaceraCloud web portal?
- Access use-case - How do I give a user access to a table or restrict from running a SQL select query?
- Access use-case - How do I restrict a user from seeing contents of a column in the result of a SQL select query?
- Column masking use-case - How do I restrict a user from seeing contents of a column by masking the values in the result of a SQL select query?
- Access use-case - How do I disallow a user from seeing certain rows of a table?
- PrivaceraCloud documentation changelog
Enable Discovery Realtime Scanning Using IAM Role
In this topic, you will learn how to use IAM roles to configure AWS S3 service for Privacera Discovery realtime scanning.
Create an IAM role with AWS S3 permissions
Log in to the AWS console.
Go to Identity and Access Management (IAM) and navigate to Access management > Roles.
Create a role or edit an existing AWS IAM role. Refer to AWS documentation on how to create an IAM Role.
Navigate to the role created or the role you are editing.
Open the role.
The role Summary page is displayed.
Copy the Role ARN.
Use the ARN in IAM Role ARN field when providing Application Properties details for the data source.
Add a policy to AWS IAM role.
Open the role you are editing.
Click Permissions tab.
On the Permissions Policies section, click Attach Policies or Add inline policy.
The Create policy page is displayed.
Click the JSON tab to add the policy and permissions.
Refer to the following sample permission JSON for the role on S3 bucket. Ensure your have Get and List actions in the permissions policy of the role and enter the bucket name in
bucket-name
.Note
You can scan multiple buckets in multiple regions or same region from a single IAM role that is configured as part of data source. This single IAM role should have access permission to access these buckets.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAccountLevelS3Actions", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:Get*" ], "Resource": "*" }, { "Sid": "AllowListAndReadS3ActionOnMyBucket", "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": [ "arn:aws:s3:::bucket-name/*", "arn:aws:s3:::bucket-name", "arn:aws:s3:::bucket1-name/*", "arn:aws:s3:::bucket1-name", "arn:aws:s3:::bucket2-name/*", "arn:aws:s3:::bucket2-name", "arn:aws:s3:::bucket3-name/*", "arn:aws:s3:::bucket3-name", "arn:aws:s3:::bucket4-name/*", "arn:aws:s3:::bucket4-name", "arn:aws:s3:::bucket5-name/*", "arn:aws:s3:::bucket5-name", "arn:aws:s3:::bucket6-name/*", "arn:aws:s3:::bucket6-name" ] }, { "Sid": "AllowReadS3ActionOnMyQueue", "Effect": "Allow", "Action": [ "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueUrl" ], "Resource": [ "<ARN of SQS queue>" ] } ] }
Note
Multiple buckets of the same region can be configured to a single SQS queue. Bucket should be mapped to the configured SQS queue in the above policy.
Click Review policy.
The Review policy section is displayed.
Enter the policy Name and click Create policy.
Establish IAM Role Trust Relationship with Discovery Data Access Role.
Open the role role you are editing.
Click the Trust relationships tab.
Click Edit trust relationship.
Refer to the following JSON to add a new policy document.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::870790086151:role/DISCOVERY_PROD_DATA_ACCESS_ROLE", "Service": "s3.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Click Update Trust Policy to save this revision.
Configure AWS S3 access using IAM role
Connect application
Go to Settings > Applications.
On the Applications screen, select S3.
Enter the application Name and Description, and then click Save.
You can see Privacera Access Management and Data Discovery with the toggle buttons.
Note
If you don't see Data Discovery in your application, enable it in Settings > Account > Discovery. For more information, see About Account
Enable Data Discovery
Click the toggle button to enable Data Discovery for your application.
On the BASIC tab, enter values in the following fields.
With Use IAM Role disabled:
AWS Access Key: AWS data repository host account Access Key.
AWS Secret Key: AWS data repository host account Secret Key.
AWS Region: AWS S3 bucket region.
For the first time, real-time discovery is disabled. See About Account for details on how to enable it.
With Use IAM Role enabled:
IAM Role ARN: Enter the actual IAM Role using a full AWS ARN.
AWS Region: AWS S3 bucket region.
On the ADVANCED tab, you can add custom properties.
Using the IMPORT PROPERTIES button, you can browse and import application properties.
Click the TEST CONNECTION button to check if the connection is successful, and then click Save.
Go to PrivaceraCloud > Privacera Discovery > Data Source to add a resources using this connection as Discovery targets. See Privacera Discovery scan targets for quick start steps.