- PrivaceraCloud Release 7.4
- Enhancements and updates in PrivaceraCloud release 7.4
- Known Issues in PrivaceraCloud 7.4
- PrivaceraCloud User Guide
- Overview of PrivaceraCloud
- Connect applications with the setup wizard
- Connect applications
- About applications
- Connect Azure Data Lake Storage Gen 2 (ADLS) to PrivaceraCloud
- Connect Amazon Textract to PrivaceraCloud
- Athena
- Privacera Discovery with Cassandra
- Connect Databricks to PrivaceraCloud
- Databricks SQL
- Databricks SQL Overview and Configuration
- Planning and general process
- Prerequisites
- Databricks SQL with Privacera Hive
- Connect Databricks SQL application
- Grant Databricks SQL permissions to PrivaceraCloud users
- Define a resource policy
- Test the policy
- Databricks SQL PolicySync fields
- Configuring column-level access control
- View-based masking functions and row-level filtering
- Create an endpoint in Databricks SQL
- Databricks SQL Fields
- Databricks SQL Hive Service Definition
- Databricks SQL Masking Functions
- Databricks SQL Encryption
- Use a custom policy repository with Databricks
- Connect Databricks SQL to Hive policy repository on PrivaceraCloud
- Databricks SQL Overview and Configuration
- Connect Databricks Unity Catalog to PrivaceraCloud
- Connect S3 to PrivaceraCloud
- Prerequisites in AWS console
- Connect S3 application to PrivaceraCloud
- Enable Privacera Access Management for S3
- Enable Data Discovery for S3
- S3 AWS Commands - Ranger Permission Mapping
- S3
- AWS Access with IAM
- Access AWS S3 buckets from multiple AWS accounts
- Add UserInfo in S3 Requests sent via Dataserver
- Control access to S3 buckets with AWS Lambda function on PrivaceraCloud
- Dremio Plugin
- DynamoDB
- Connect Elastic MapReduce from Amazon application to PrivaceraCloud
- Connect EMR application
- EMR Spark access control types
- PrivaceraCloud configuration
- AWS IAM roles using CloudFormation setup
- Create a security configuration
- Create EMR cluster
- How to configure multiple JSON Web Tokens (JWTs) for EMR
- EMR Native Ranger Integration with PrivaceraCloud
- Connect EMRFS S3 to PrivaceraCloud
- Files
- GBQ
- Google Cloud Storage
- Connect Glue to PrivaceraCloud
- Google BigQuery for PolicySync
- Connect Kinesis to PrivaceraCloud
- Connect Lambda to PrivaceraCloud
- Microsoft SQL Server
- MySQL for Discovery
- Open Source Apache Spark
- Oracle for Discovery
- PostgreSQL
- Connect Power BI to PrivaceraCloud
- Presto
- Redshift
- Snowflake
- Starburst Enterprise with PrivaceraCloud
- Starburst Enterprise Presto
- Trino
- Connect users
- Data access Users, Groups, and Roles
- UserSync
- Portal user LDAP/AD
- Datasource
- Okta Setup for SAML-SSO
- Azure AD setup
- SCIM Server User-Provisioning
- User Management
- Identity
- Access Manager
- Access Manager
- Resource Policies
- Tag Policies
- Scheme Policies
- Service Explorer
- Reports
- Audit
- About data access users, groups, and roles resource policies
- Security zones
- Discovery
- Classifications via random sampling
- Privacera Discovery scan targets
- Propagate Privacera Discovery Tags to Ranger
- Enable offline scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Real-time Scanning of S3 Buckets
- Enable Real-time Scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Discovery Realtime Scanning Using IAM Role
- Encryption
- Overview of Privacera Encryption
- Encryption schemes
- Presentation schemes
- Masking schemes
- Create scheme policies
- Privacera-supplied encryption schemes for the Privacera API
- Privacera-supplied encryption schemes for the Bouncy Castle API
- API date input formats
- Deprecated encryption formats, algorithms, and scopes
- Privacera Encryption REST API
- PEG API endpoint
- PEG REST API encryption endpoints
- Prerequisites
- Common PEG REST API fields
- Construct the datalist for the /protect endpoint
- Deconstruct the response from the /unprotect endpoint
- Example data transformation with the /unprotect endpoint and presentation scheme
- Example PEG API endpoints
- Make encryption API calls on behalf of another user
- Privacera Encryption UDF for masking in Databricks on PrivaceraCloud
- Privacera Encryption UDFs for Trino on PrivaceraCloud
- Syntax of Privacera Encryption UDFs for Trino
- Prerequisites for installing Privacera Crypto plug-in for Trino
- Download and install Privacera Crypto jar
- Set variables in Trino etc/crypto.properties
- Restart Trino to register the Privacera encryption and masking UDFs for Trino
- Example queries to verify Privacera-supplied UDFs
- Privacera Encryption UDF for masking in Trino on PrivaceraCloud
- Encryption UDFs for Apache Spark on PrivaceraCloud
- Launch Pad
- Settings
- Dashboard
- Usage statistics
- Operational status of PrivaceraCloud and RSS feed
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- PrivaceraCloud Previews
- Preview: File Explorer for S3
- Preview: File Explorer for Azure
- Preview: File Explorer for GCS
- Preview: Scan Generic Records with NER Model
- Preview: Scan Electronic Health Records with NER Model
- Preview: OneLogin setup for SAML-SSO
- Preview: Azure Active Directory SCIM Server UserSync
- Preview: OneLogin UserSync
- Preview: PingFederate UserSync
- Quickstart for Databricks Unity Catalog on PrivaceraCloud
- What do I need to do in my Databricks Workspace?
- Where is the sample dataset in my Databricks Workspace?
- What should I do in the PrivaceraCloud web portal?
- Access use-case - How do I give a user access to a table or restrict from running a SQL select query?
- Access use-case - How do I restrict a user from seeing contents of a column in the result of a SQL select query?
- Column masking use-case - How do I restrict a user from seeing contents of a column by masking the values in the result of a SQL select query?
- Access use-case - How do I disallow a user from seeing certain rows of a table?
- PrivaceraCloud documentation changelog
Starburst Enterprise with PrivaceraCloud
PrivaceraCloud can provide system-wide access control across all data exposed in Starburst Enterprise.
Both privacera_hive and privacera_starburstenterprise resource policies can be used to integrate with both Starburst managed sources as well as 3rd party sources (such as Databricks) to maintain policy consistency.
Note
A common implementation pattern for data sources not directly supported in Privacera is to use Starburst Enterprise as a point of access policy enforcement. Create a layer of views in Starburst Enterprise on top of the unsupported source, apply Privacera access control policies to those views, and then limit most access to the source outside of Starburst Enterprise.
Starburst Enterprise is often deployed using a pre-built Docker image provided by Starburst. Using a Docker image for testing and single node deployment can be significantly faster than working with either RPM or tarball deployments. The instructions here describe the container-based deployment but other environments are similar. The following information explains how to configure Starburst Enterprise with port 8443 for TLS/HTTPS so that usernames/passwords are possible.
Note
PrivaceraCloud is a managed service so there is currently no option for connecting to a secured Starburst Enterprise instance that utilizes self-signed SSL certificates. The reason for this is because self-signed certificates are not chained to a publicly authenticated root certificate authority ("ca-root").
Prerequisites
The following items need to be enabled or shared prior to deploying a Starburst Docker image:
A licensed version of Starburst.
Docker-ce 18+ must be installed.
JDK 11 to generate the Java keystore.
JDBC URL to connect to the Starburst Enterprise instance, including catalog and schema. Unless you specify a catalog name, the JDBC connection is validated only to the host level.
CA-signed SSL certificate for production deployment.
Your PrivaceraCloud API Key.
Configure Privacera plug-in with Starburst Enterprise
Note
The Docker image already includes the Privacera plug-in needed for policy enforcement. Your tasks will be to create or update a number of configuration files in the container.
Summary of steps:
Generate access-control file(s) for Starburst (required) and for Hive catalogs (optional).
Generate a Ranger Audit XML file.
Generate a Ranger SSL XML file.
Generate a PrivaceraCloud JCEKS file.
Generate access-control files
To enable Privacera for authorization, you need to update the etc/config.properties file with one of the following entries:
prop # privacera auth for hive and system access control access-control.config-files=/etc/starburst/access-control-privacera.properties,/etc/starburst/access-control-priv-hive.properties
Or
prop # privacera auth for only system access control access-control.config-files=/etc/starburst/access-control-privacera.properties
Generate a Ranger Audit XML file
The example below depends on your individual PrivaceraCloud API Key, which you must insert in three places below.
etc/ranger-hive-audit.xml
<?xml version="1.0" encoding="UTF-8"?> <configuration> <property> <name>ranger.plugin.hive.service.name</name> <value>privacera_hive</value> </property> <property> <name>ranger.plugin.hive.policy.pollIntervalMs</name> <value>5000</value> </property> <property> <name>ranger.service.store.rest.url</name> <value> https://<YOUR_PRIVACERACLOUD_API_URL>/<API_KEY> </value> </property> <property> <name>ranger.plugin.hive.policy.rest.url</name> <value> https://<YOUR_PRIVACERACLOUD_API_URL>/<API_KEY> </value> </property> <property> <name>ranger.plugin.hive.policy.source.impl</name> <value>org.apache.ranger.admin.client.RangerAdminRESTClient</value> <description> Class to retrieve policies from the source </description> </property> <property> <name>ranger.plugin.hive.policy.rest.ssl.config.file</name> <value>/etc/starburst/ranger-policymgr-ssl.xml</value> <description> Path to the file containing SSL details to contact Ranger Admin </description> </property> <property> <name>ranger.service.store.rest.ssl.config.file</name> <value>/etc/starburst/ranger-policymgr-ssl.xml</value> </property> <property> <name>ranger.plugin.hive.policy.cache.dir</name> <value>/etc/starburst/tmp/ranger</value> <description> Directory where Ranger policies are cached after successful retrieval from the source </description> </property> <property> <name>ranger.plugin.starburst-enterprise-presto.policy.cache.dir</name> <value>/etc/starburst/tmp/ranger</value> <description> Directory where Ranger policies are cached after successful retrieval from the source </description> </property> <property> <name>xasecure.audit.destination.solr</name> <value>true</value> </property> <property> <name>xasecure.audit.destination.solr.batch.filespool.dir</name> <value>/etc/starburst/tmp/solr</value> </property> <property> <name>xasecure.audit.destination.solr.urls</name> <value> https://<YOUR_PRIVACERACLOUD_API_URL>/<API_KEY>/solr/ranger_audits </value> </property> <property> <name>xasecure.audit.is.enabled</name> <value>true</value> </property> <property> <name>xasecure.audit.solr.is.enabled</name> <value>true</value> </property> <property> <name>xasecure.audit.solr.async.max.queue.size</name> <value>1</value> </property> <property> <name>xasecure.audit.solr.async.max.flush.interval.ms</name> <value>1000</value> </property> </configuration>
To install this file into the Docker container, you can add an option to your container creation script:
-v $DOCKER_HOME/$STARBURST_VERSION/etc/ranger-hive-audit.xml:$STARBURST_TGT/ranger-hive-audit.xml
Generate a Ranger SSL XML file
The Ranger SSL XML file is needed when using PrivaceraCloud. This is because it uses API keys and the location of the JDK inside the Starburst containers might be different than other installations.
After the change from starburst-presto to starburst-trino releases, the JDK installation was updated by the Starburst engineering team.
Note
The <value> tags that follow should be verified periodically or based on best practices from Starburst engineering or partner teams.
etc/ranger-policymgr-ssl.xml
<?xml version="1.0" encoding="UTF-8"?> <configuration> <property> <name>xasecure.policymgr.clientssl.truststore</name> <value>/etc/pki/java/cacerts</value> </property> <property> <name>xasecure.policymgr.clientssl.truststore.password</name> <value>crypted</value> </property> <property> <name>xasecure.policymgr.clientssl.truststore.credential.file</name> <value>jceks://file/etc/starburst/privaceracloud.jceks</value> </property> </configuration>
To install this file into the Docker container, you can add an option to your container creation script:
-v $DOCKER_HOME/$STARBURST_VERSION/etc/ranger-policymgr-ssl.xml:$STARBURST_TGT/ranger-polcymgr-ssl.xml
Generate a PrivaceraCloud JCEKS file
Edit etc/privaceracloud.jceks.
This file is for an encrypted password for reading or accessing the Java CACerts inside the Starburst containers.
If you are generating a JCEKS with the default Java Truststore password (“changeit”), you can use an existing Hive Metastore environment or an Hadoop distribution that is running Java 8 or newer.
Example CLI:
hadoop credential create sslTrustStore -value changeit -provider localjceks://file/var/tmp/privaceracloud.jceks
To install this file into the Docker container, you can add an option to your container creation script:
-v $DOCKER_HOME/$STARBURST_VERSION/etc/privaceracloud.jceks:$STARBURST_TGT/privaceracloud.jceks
Connect Starburst Enterprise application
Use the following steps to connect Starburst Enterprise application to the PrivaceraCloud for Privacera Access Management.
Login to PrivaceraCloud.
Go to Settings > Applications.
On the Applications screen, select Starburst Enterprise.
Enter the application Name and Description, and then click Save.
Click the toggle button to enable the Privacera Access Management for Starburst Enterprise.
You will see this message, Save the setting to start controlling access on Starburst Enterprise.
Click Save.