Create Virtual Resources and MDS Policies¶

Resources are not discovered automatically. Declare them in the Data Catalog before a policy can reference them. This is called a virtual resource.

One API call creates the virtual resource, if it does not already exist, and the matching access policy. The revoke call also creates the resource if it does not exist.

A successful call returns 200 OK with an empty body, even when nothing changed. A revoke that matches no grant, for example because the path differs in case, also returns 200 OK. To confirm the result, go to Data Browser → Data Catalog, open the resource, and check that its access permissions list the principal with the expected permission. The resource being present is not proof, because both calls create it.

Get the API base URL¶

Set Content-Type: application/json on every request.

The examples use the default service repositories. If this connector uses a custom service repository, set serviceName to its name. See Custom Service Repo for Access Management for Starburst Trino.

Hive¶

Grant read access¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

curl -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer <mds-token>' \
    -d '{
      "resource": {
        "serviceName": "privacera_hive",
        "serviceType": "HIVE",
        "resourceType": "TABLE",
        "resourcePath": "<database>/<table>"
      },
      "grant": {
        "permission": "READ",
        "principals": {
          "users": ["<user>"],
          "groups": ["<group>"],
          "roles": ["<role>"]
        }
      }
    }' \
    <mds-base-url>/api/v2/metadata/omni-policies/enforcement/grant-access/resources

Replace the placeholders and check serviceName:

Grant write access¶

Send the same request with "permission": "WRITE".

READ and WRITE expand to these Hive access types:

Leave accessTypes unset.

Revoke access¶

Send the same resource with a revoke object that holds only principals, to <mds-base-url>/api/v2/metadata/omni-policies/enforcement/revoke-access/resources. Leave out permission.

Revoke removes all access, READ and WRITE, that the listed principals have on the resource. To downgrade WRITE to READ, grant READ instead. A new grant replaces the existing one.

Resource types¶

Set resourceType and resourcePath to the level the policy applies to:

A TABLE grant covers every column of the table, including columns added later. Use the narrowest level.

Masking and row-level filtering are not created by this call. Hive mask types are MASK_HASH, MASK_NULL, MASK_SHOW_FIRST_4, MASK_SHOW_LAST_4, and MASK_NONE.

Trino¶

Grant read access¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

curl -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer <mds-token>' \
    -d '{
      "resource": {
        "serviceName": "privacera_trino",
        "serviceType": "TRINO",
        "resourceType": "TABLE",
        "resourcePath": "<catalog>/<schema>/<table>"
      },
      "grant": {
        "permission": "READ",
        "principals": {
          "users": ["<user>"],
          "groups": ["<group>"],
          "roles": ["<role>"]
        }
      }
    }' \
    <mds-base-url>/api/v2/metadata/omni-policies/enforcement/grant-access/resources

Replace the placeholders and check serviceName:

Grant write access¶

Send the same request with "permission": "WRITE".

READ and WRITE expand to these Trino access types:

WRITE is an administrative grant. Use READ unless the principal must administer the resource.

Leave accessTypes unset.

Revoke access¶

Send the same resource with a revoke object that holds only principals, to <mds-base-url>/api/v2/metadata/omni-policies/enforcement/revoke-access/resources. Leave out permission.

Revoke removes all access, READ and WRITE, that the listed principals have on the resource. To downgrade WRITE to READ, grant READ instead. A new grant replaces the existing one.

Resource types¶

Set resourceType and resourcePath to the level the policy applies to:

A TABLE grant covers every column of the table, including columns added later. Use the narrowest level.

Masking and row-level filtering are not created by this call. Trino mask types are MASK_HASH, MASK_NULL, MASK_SHOW_FIRST_4, MASK_SHOW_LAST_4, and MASK_NONE.

S3¶

<bucket>/user/data/sample/

Grant read access¶

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

curl -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer <mds-token>' \
    -d '{
      "resource": {
        "serviceName": "privacera_s3",
        "serviceType": "S3",
        "resourceType": "OBJECTPATH",
        "resourcePath": "<bucket>/<prefix>/"
      },
      "grant": {
        "permission": "READ",
        "principals": {
          "users": ["<user>"],
          "groups": ["<group>"],
          "roles": ["<role>"]
        }
      }
    }' \
    <mds-base-url>/api/v2/metadata/omni-policies/enforcement/grant-access/resources

Replace the placeholders and check serviceName:

Grant write access¶

Send the same request with "permission": "WRITE".

READ and WRITE expand to these S3 access types:

Leave accessTypes unset.

Revoke access¶

Send the same resource with a revoke object that holds only principals.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

curl -X POST \
    -H 'Content-Type: application/json' \
    -H 'Authorization: Bearer <mds-token>' \
    -d '{
      "resource": {
        "serviceName": "privacera_s3",
        "serviceType": "S3",
        "resourceType": "OBJECTPATH",
        "resourcePath": "<bucket>/<prefix>/"
      },
      "revoke": {
        "principals": {
          "users": ["<user>"],
          "groups": ["<group>"],
          "roles": ["<role>"]
        }
      }
    }' \
    <mds-base-url>/api/v2/metadata/omni-policies/enforcement/revoke-access/resources

Revoke removes all access, READ and WRITE, that the listed principals have on the resource. To downgrade WRITE to READ, grant READ instead. A new grant replaces the existing one.

Resource types¶

S3 resources have two levels:

Masking and row-level filtering do not apply to S3.

Create tag-based and other policies¶

Once a resource is in the Data Catalog:

For a tag-based policy, tag the resources first, then set the policy Data scope to Data Tag.

Verify¶

Run these from the Starburst Trino CLI — see Run Starburst Trino CLI. Run each check twice: once as a granted user and once as a denied user.

Hive catalog table¶

Checks the Hive policy.

1

SELECT * FROM hive.<database>.<table> LIMIT 10;

Iceberg catalog table¶

Checks the Trino policy.

1

SELECT * FROM <iceberg-catalog>.<schema>.<table> LIMIT 10;

Create a database on an S3 location¶

Checks the S3 policy together with the catalog policy. The READ grants above are not enough. Before this check, grant the user WRITE on:

• privacera_hive, resource type DATABASE, path <database>
• privacera_s3, resource type OBJECTPATH, path <bucket>/<prefix>/

1

CREATE SCHEMA hive.<database> WITH (location = 's3://<bucket>/<prefix>/');

The statement creates the schema, so a second run fails with "already exists". Drop it after the check:

1

DROP SCHEMA hive.<database>;

Then, in the portal, go to Access Management → Audits → ACCESS and confirm an Allowed or Denied record for that user and resource.