Run Boto3 Use Case in Apache Spark OLAC¶

Prerequisites¶

• The Spark plugin image must be built with Privacera Boto3 Signer support enabled. Refer Enable Boto3 Signer Support.
• The Privacera Boto3 Signer supports only JWT authentication. JWT authentication must be enabled and configured in Privacera. Refer Configuring JWT for Authentication.

Steps¶

1. Connect to the Kubernetes pod where the Spark plugin is deployed

   Bash
   1	kubectl exec -it <spark-plugin-pod-name> -n <namespace> -- bash

2. Verify the signer is installed:

   Bash
   1	python3 -c "import privacera_boto3_signer"

3. Export the signer runtime configuration. Set the DataServer external URL and the JWT token for the identity to run the use case as.

   Bash
   1 2	export PRIVACERA_SIGNER_BASE_URL="<https://dataserver-endpoint-url>" export PRIVACERA_JWT_TOKEN_STR="<jwt-token>"

4. Start Python and run the boto3 use case. The signer prints its auto-registration messages at startup, confirming boto3 calls are routed through Privacera:

   Bash
   1	python3

   Expected startup output

   INFO     [PRIVACERA] Privacera auto-registration enabled
   INFO     [PRIVACERA] Boto3 client and resource wrapped for Privacera auto-registration
   

   • Read and write S3 objects with plain boto3 code:

     Python
     1 2 3 4 5 6 7 8 9 10	import boto3 client = boto3.client("s3") # Read input object response = client.get_object(Bucket="<bucket-name>", Key="input/data.csv") input_data = response["Body"].read() # Write output object client.put_object(Bucket="<bucket-name>", Key="output/data.csv", Body=input_data)

5. Validate policy enforcement:

   • If access is denied, the call fails with botocore.exceptions.ClientError: An error occurred (AccessDenied) and a Denied audit record appears in the Privacera Portal under Access Management → Audits.
   • In the Privacera Portal, grant the required Read/Write permissions to the identity under Access Management → Resource Policies → privacera_s3, then re-run the use case.