Skip to content

Configure External Location Access Check

External Location Access Policy Evaluation Order for Catalogs

Note

This Feature is enabled by default.

External Location access control for different catalog types follows a defined evaluation order across the configured Privacera policy repositories. Based on the catalog type (e.g., Hive or others), the plugin checks each repository in sequence, granting access based on the first applicable policy.

Catalog Access Check Order Notes
Hive
  • privacera_s3
  • privacera_files
  • privacera_hive
 The plugin first checks the privacera_s3 repository. If unavailable or no S3 policy allows access, it falls back to privacera_files. If access is still not granted, it finally checks privacera_hive.
Other Catalogs
  • privacera_s3
  • privacera_files
 The plugin first attempts to use privacera_s3. If unavailable or no S3 policy permits access, it checks privacera_files.
Note: The privacera_hive repository is not applicable to non-Hive catalogs.

Disable External Location Access Check

Disabling external location access check is not recommended

Disabling external location access check is not recommended. It may lead to security vulnerabilities.

  1. SSH to the instance where Privacera is installed.

  2. Run the following command to navigate to the /config directory.

    Bash
    1
    cd ~/privacera/privacera-manager/config

  3. Run the following command to open the .yml file to be edited.

    Bash
    1
    vi custom-vars/vars.trino-opensource.yml

  4. Update the following property

    YAML
    1
    TRINO_FILE_LOCATION_AUTHZ_ENABLED: "false"

  5. Once the property is configured, update your Privacera Manager platform instance by following the commands.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  6. Now rebuild the image and redeploy the application.

Follow below steps to disable s3 location access check with privacera-trino plugin on PrivaceraCloud.

  • Navigate to the privacera-trino-plugin directory, which contains all the Trino plugin deployment related files.

    Bash
    1
2
    cd ~/privacera-trino-plugin
vi values.yaml

  • Update the following property in the values.yaml file

    YAML
    1
2
3
    env:
- name: TRINO_FILE_LOCATION_AUTHZ_ENABLED
  value: "false"

  • Once the property is configured, proceed with redeploying the Helm chart.