Skip to main content

Privacera Documentation

Access Management methods

Privacera Access Management works with and extends Apache Ranger to provide data access governance with centralized management of authorization policies and auditing.

There are several approaches to policy enforcement based on the data store and the type of access. All provide consolidated audit logging. And in all cases, data does not have to stream through Privacera’s code, so the overhead added by any policy enforcement is kept to a minimum.

Access control using Apache Ranger plug-ins

Where available, Privacera leverages Apache Ranger-style distributed policy enforcement points for access control. Many data processing engines, such as Hive, Spark and Presto, support these plugins. Policies created and managed in the Privacera portal are distributed to and synchronized with these policy enforcement points. Access control decisions happen at the engine, inline with query execution.

For the following plug-ins, the sync interval for retrieving Apache Ranger policies applies:

  • Databricks fine-grained access control (FGAC) plug-in: 3 seconds

  • Amazon EMR Presto plug-in: 2 seconds

  • Amazon EMR Hive plug-in: 2 seconds

  • Amazon EMR Trino (previously PrestoSQL): 5 seconds

Access control using Privacera PolicySync

For data sources like RDBMS where Ranger-style access control plugins are not available, access control policies are enforced via policy synchronization. Privacera’s PolicySync component translates the configured access control policies into the data source’s native access control framework, for example by sending a relational database GRANT/REVOKE statements, generating views where needed for additional layers of access control like data masking and row filtering, and so on. When there are policy changes in Privacera, new or changed objects in the data source, or changes to users, groups and roles, updates are pushed to the data source to keep it aligned with the latest policies.

PolicySync syncs Apache Ranger access policies at 3 second intervals by default, and this interval is configurable per PolicySync connector. In addition to the sync interval, PolicySync reconciles any access policy changes with the data source, and this requires additional time that varies with the complexity of the reconciliation required, such as adding and removing grants.

Access control using the Privacera Data Access Server

For data in object stores like S3 or ADLS, access requests flow through Privacera’s Data Access Server for policy enforcement. The Data Access Server integration method redirects data access requests to a Privacera ‘authentication broker’ inserted into the control and data flow. For requests that are allowed based on authentication and other policy checks, the authentication broker generates a signed URL that the requester can use to fetch the requested data directly from the object store. All access attempts are audited.

Data Access Server syncs Apache Ranger access policies at 5 second intervals.

For details on configuring Data Access Server, see Integrate AWS with Privacera Platform using the Data Access Server.