Skip to main content

PrivaceraCloud Documentation

Tag Policies

:

A tag is user-assigned metadata label classifying a resource such as a column, table, or file. Access policies can then be defined by referencing tags values that apply to the tagged data. A single tag can be applied to data resources sourced across multiple data sources or types of data. This allows data managers to create and manage data across scattered resources, based on a user-assigned attribute, reducing the need to define policies for otherwise disjoint resources.

For example, database columns called Email or Phone_Number found in multiple databases can be tagged as PII. Policies can then be written for that PII tagged data.

Tags are defined and assigned using the PrivaceraCloud Apache Ranger API. See Apache Ranger API for general information on using this API interface.Apache Ranger API

Each PrivaceraCloud account is assigned a unique URL to access and control account resources. This URL is obtained via the API Key.

Tags can also be defined and assigned using Privacera Discovery, a Privacera Platform component. These tag definition sets can then be subsequently exported from Privacera Discovery and imported into PrivaceraCloud.

See Apache Ranger Tag APIs for the full set of Ranger Apache REST Tag APIs.

Example: Tag Assignment via Apache Ranger API

In the following example a tag named "PERSON_NAME" is applied to a Hive database named: "sales" with a table named: "sales_data", and a column named : "name".

A PUT is targeted to the endpoint tags/importservicetags of the Apache Ranger API with access credentials (username: "RangerAPI-Auth"; password: "ranger1234#"). The local file atlas_tag.json containst the request the body.Apache Ranger API

curl -u RangerAPI-Auth:ranger1234# \
-H "Content-type: application/json" \
-d @atlas_tag.json \
-X PUT \
https://api.privaceracloud.com/api/13afxxxxxx6b981fxxxxxx2dc7cdd7xxxxxxa921636xxxxxx2d189d425b5f01/service/tags/importservicetags

where atlas_tag.json is:

    {
     "op": "add_or_update",
     "serviceName": "privacera_hive",
     "tagVersion": 0,
     "tagDefinitions": {
       "0": {
         "name": "PERSON_NAME",
         "source": "Atlas",
         "attributeDefs": [],
         "id": 0,
         "isEnabled": true
       }
     },
     "tags": {
       "0": {
         "type": "PERSON_NAME",
         "owner": 0,
         "attributes": {},
         "id": 0,
         "isEnabled": true
       }
     },
     "serviceResources": [
       {
         "serviceName": "privacera_hive",
         "resourceElements": {
           "database": {
             "values": [
               "sales"
             ],
             "isExcludes": false,
             "isRecursive": false
           },
           "column": {
             "values": [
               "name"
             ],
             "isExcludes": false,
             "isRecursive": false
           },
           "table": {
             "values": [
               "sales_data"
             ],
             "isExcludes": false,
             "isRecursive": false
           }
         },
         "id": 0,
         "isEnabled": true
       }
     ],
     "resourceToTagIds": {
       "0": [
         0
       ]
     }
    }

Add the privacera_tag Service

  1. Open Access Manager > Tag Policies > Add Service.

  2. In the TAG service group, select privacera_tag by clicking its name.

  3. Save the service.

Tag Policies UI

Click Access Manager: Tag Policies to open and manage Tag based policies.

Once a tag policy has been created, it will display a service group named TAG, and one or more tag services. The first tag policy is named, by default, privacera_tag.

The controls and policy definition sequences are mirror those in Resource Policies.

Example

This example sequence creates a policy for data tagged "PERSON_NAME". The tag must have been previously created and assigned using the PrivaceraCloud Apache Ranger API, or as an import from a Privacera Discovery created tag assignment definition file.

  1. Open Access Manager > Tag Policies. Open the service: privacera_tag (click the name) in the service group TAG.

  2. Click the “Add New Policy” button to add a new tag based policy.

  3. This will open to a new Policy definition dialog. Create a new Policy as in Resource Policies.