Access Type Exclusions¶

Overview¶

When you create policies in the Privacera portal for Lakeformation resources (for example, database or table), the set of permissions available for each resource type is displayed. By default, the connector syncs those permissions to AWS Lakeformation according to the policy.

Access Type Exclusions allow you to prevent specific permissions from syncing to Lakeformation for a given resource type. Even if a permission is granted within a Privacera policy, it will be ignored during the sync process if it is defined in the exclusion list.

Use access type exclusions when you want to prevent certain permissions (for example, ALTER or DROP) from being pushed to Lakeformation for specific resource types.

Configuration¶

Access type exclusions are defined as custom properties.

File Path
Modify the connector-custom.properties file located in your connector instance directory: config/custom-vars/connectors/lakeformation/<instance>/custom/connector-custom.properties. See Configuring Custom Properties for Connectors for Connectors for how to add and deploy custom properties.

Property¶

Define the property: Use the following pattern to define an exclusion.
ranger.policysync.connector.0.access.type.exclusions.<resourceType>

• <resourceType> : The target resource (see the Resource Mapping Table below).
• Value: A comma-separated (no spaces) list of permissions to exclude.

• Resource Mapping Table: Use the corresponding resource type for the property from the following table.

  Portal name	Use in property
  Catalog	catalog
  Region	region
  Database	database
  Table	table
  Column	column
  Data Location	data_location
  Tag	tag
  Database Resource Link	database_resource_link
  Table Resource Link	table_resource_link

Exclusions are applied when the connector starts. Only the permissions listed in the property are excluded. All other permissions for the resource type continue to sync as usual.

Examples¶

• Exclude ALTER and DROP for database:

1

ranger.policysync.connector.0.access.type.exclusions.database=ALTER,DROP

• Exclude DROP for table:

1

ranger.policysync.connector.0.access.type.exclusions.table=DROP

• Exclude multiple permissions for table:

1

ranger.policysync.connector.0.access.type.exclusions.table=ALTER,DROP,DELETE

Notes¶

• The value (comma-separated permission names) must be in upper case (e.g., ALTER, DROP, SELECT).
• Permission names must use underscores instead of spaces (e.g., use CREATE_TABLE, not CREATE TABLE).
• Exclusions are applied per resource type. You must configure a separate property for each resource type.
• If a property is present but the value is empty, no exclusions are applied.

Setup¶