PolicySync

The following table contains the list of custom properties that can be configured for PolicySync connectors. To use a custom property from the table, just add it to the following YML file in the custom-vars folder configured as per your environment:

• vars.policysync.snowflake.yml
• vars.policysync.postgres.yml
• vars.policysync.mssql.yml
• vars.policysync.redshift.yml
• vars.policysync.databricks.sql.analytics.yml
• vars.policysync.bigquery.yml
• vars.policysync.powerbi.yml

Property	Description	Values	Default Value
POLICYSYNC_IMAGE_NAME	Mention the PolicySync image name.
POLICYSYNC_IMAGE_TAG	Mention the PolicySync image tag.
POLICYSYNC_ENABLE	Enable PolicySync.	true/false	false

Common

Property	Description	Values	Default Value
POLICYSYNC_USERLOADER_RANGER_PERSIST_CASE_SENSITIVITY	After loading user/group/roles from Apache Ranger API's all are converted into lowercase, but in some cases, you would need to have the users in the same case as they are in Apache Ranger. When setting this value to true, it will maintain the case sensitivity of names as they are in Apache Ranger.	true/false	false
DEPLOYMENT_SIZE	This property specifies the size of the PolicySync deployment.	SMALL, MEDIUM or LARGE	SMALL
Memory Variables
POLICYSYNC_HEAP_MIN_MEMORY_MB	Minimum Java Heap memory in MB used by PolicySync. For example, POLICYSYNC_HEAP_MIN_MEMORY_MB: "1024"	Depends upon DEPLOYMENT_SIZE If DEPLOYMENT_SIZE property value is MEDIUM then the memory is 8192 If DEPLOYMENT_SIZE property value is LARGE then the memory is 32768
POLICYSYNC_HEAP_MIN_MEMORY	Minimum Java Heap memory used by PolicySync. Setting this value will override POLICYSYNC_HEAP_MIN_MEMORY_MB. For example, POLICYSYNC_HEAP_MIN_MEMORY: "1g"		POLICYSYNC_HEAP_MIN_MEMORY_MB
POLICYSYNC_HEAP_MAX_MEMORY_MB	Maximum Java Heap memory in MB used by PolicySync. For example, POLICYSYNC_HEAP_MAX_MEMORY_MB: "1024"	Depends upon DEPLOYMENT_SIZE If DEPLOYMENT_SIZE property value is SMALL then the memory is 2048 If DEPLOYMENT_SIZE property value is MEDIUM then the memory is 8192 If DEPLOYMENT_SIZE property value is LARGE then the memory is 32768
POLICYSYNC_HEAP_MAX_MEMORY	Maximum Java Heap memory used by PolicySync. Setting this value will override POLICYSYNC_HEAP_MAX_MEMORY_MB. For example, POLICYSYNC_HEAP_MAX_MEMORY: "1g"
POLICYSYNC_K8S_MEM_REQUESTS_MB	Minimum amount of Kubernetes memory in MB to be requested by PolicySync. For example, POLICYSYNC_K8S_MEM_REQUESTS_MB: "1024"
POLICYSYNC_K8S_MEM_REQUESTS	Minimum amount of Kubernetes memory to be used by PolicySync. Setting this value will override POLICYSYNC_K8S_MEM_REQUESTS_MB. For example, POLICYSYNC_K8S_MEM_REQUESTS: "1G"
POLICYSYNC_K8S_MEM_LIMITS_MB	Maximum amount of Kubernetes memory in MB to be requested by PolicySync. For example, POLICYSYNC_K8S_MEM_LIMITS_MB: "1024"
POLICYSYNC_K8S_MEM_LIMITS	Maximum amount of Kubernetes memory to be used by PolicySync. Setting this value will override POLICYSYNC_K8S_MEM_LIMITS_MB. For example, POLICYSYNC_K8S_MEM_LIMITS: "1G"		POLICYSYNC_K8S_MEM_LIMITS_MB
POLICYSYNC_CPU_MIN	Minimum amount of Kubernetes CPU to be requested by PolicySync. For example, POLICYSYNC_CPU_MIN: "0.5"	Depends upon DEPLOYMENT_SIZE If DEPLOYMENT_SIZE property value is MEDIUM then the CPU required is 4 If DEPLOYMENT_SIZE property value is LARGE then the CPU required is 8
POLICYSYNC_CPU_MAX	Maximum amount of Kubernetes CPU to be used by PolicySync. For example, POLICYSYNC_CPU_MAX: "0.5"	Depends upon DEPLOYMENT_SIZE If DEPLOYMENT_SIZE property value is SMALL then the CPU required is 2 If DEPLOYMENT_SIZE property value is MEDIUM then the CPU required is 4 If DEPLOYMENT_SIZE property value is LARGE then the CPU required is 8

Connectors Global Properties

Snowflake Connector

JDBC configuration

Name	Type	Default	Required	Description
SNOWFLAKE_JDBC_URL	string		Yes	Specifies the JDBC URL for the Snowflake connector.
SNOWFLAKE_JDBC_USERNAME	string		Yes	Specifies the JDBC username to use.
SNOWFLAKE_JDBC_PASSWORD	string		Yes	Specifies the JDBC password to use.
SNOWFLAKE_USE_KEY_PAIR_AUTHENTICATION	boolean	false	Yes	Specifies whether PolicySync uses key-pair authentication. Set this property to true to enable key pair authentication.
SNOWFLAKE_JDBC_PRIVATE_KEY_FILE_NAME	string		No	Specifies the file name of the private key that PolicySync uses for key-pair authentication. This file is placed in the ~/privacera/privacera-manager/config/custom-vars directory. Specify this setting only if SNOWFLAKE_USE_KEY_PAIR_AUTHENTICATION is set to true.
SNOWFLAKE_JDBC_PRIVATE_KEY_PASSWORD	string		No	Specifies the password for the private key. If the private key does not have a password, do not specify this setting. Specify this setting only if SNOWFLAKE_USE_KEY_PAIR_AUTHENTICATION is set to true.
SNOWFLAKE_WAREHOUSE_TO_USE	string		Yes	Specifies the JDBC warehouse that PolicySync establishes a connection to, which is used to run SQL queries.
SNOWFLAKE_ROLE_TO_USE	string		Yes	Specifies the role that PolicySync uses when it runs SQL queries.
JDBC_MAX_POOL_SIZE	integer	15	No	Specifies the maximum size for the JDBC connection pool.
JDBC_MIN_IDLE_CONNECTION	integer	3	No	Specifies the minimum size of the JDBC connection pool.
JDBC_LEAK_DETECTION_THRESHOLD	string	900000L	No	Specifies the duration in milliseconds that a connection is not part of the connection pool before PolicySync logs a possible connection leak message. If set to 0, leak detection is disabled.

Resource management

Name	Type	Default	Required	Description
SNOWFLAKE_OWNER_ROLE	string		No	Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user. If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource. If a value is specified, the owner of the resource will be changed to the specified value. The following resource types are supported: Database Schemas Tables Views
SNOWFLAKE_HANDLE_PIPE_OWNERSHIP	boolean	false	No	Specifies whether PolicySync changes the ownership of a pipe to the role specified by SNOWFLAKE_OWNER_ROLE.
SNOWFLAKE_MANAGE_WAREHOUSE_LIST	string		No	Specifies a comma-separated list of warehouse names for which PolicySync manages access control. If unset, access control is managed for all warehouses. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of warehouses might resemble the following: testdb1warehouse,testdb2warehouse, sales_dbwarehouse*
SNOWFLAKE_MANAGE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of databases might resemble the following: testdb1,testdb2,sales db*. If specified, SNOWFLAKE_IGNORE_DATABASE_LIST takes precedence over this setting.
SNOWFLAKE_MANAGE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a schema: <DATABASE_NAME>.<SCHEMA_NAME> If specified, SNOWFLAKE_IGNORE_SCHEMA_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all schemas are managed: <DATABASE_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all schemas. If set to none no schemas are managed.
SNOWFLAKE_MANAGE_TABLE_LIST	string		No	Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a table: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> If specified, SNOWFLAKE_IGNORE_TABLE_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all matched tables are managed: <DATABASE_NAME>.<SCHEMA_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all tables. If set to none no tables are managed.
SNOWFLAKE_MANAGE_STREAM_LIST	string		No	Specifies a comma-separated list of stream names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of streams might resemble the following: testdb1.schema1.stream1,testdb2.schema2.stream* If unset, access control is managed for all streams.
SNOWFLAKE_MANAGE_FUNCTION_LIST	string		No	Specifies a comma-separated list of function names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of functions might resemble the following: testdb1.schema1.fn1,testdb2.schema2.fn* If unset, access control is managed for all functions.
SNOWFLAKE_MANAGE_PROCEDURE_LIST	string		No	Specifies a comma-separated list of procedure names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of procedures might resemble the following: testdb1.schema1.procedureA,testdb2.schema2.procedure* If unset, access control is managed for all procedures.
SNOWFLAKE_MANAGE_SEQUENCE_LIST	string		No	Specifies a comma-separated list of sequence names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of sequences might resemble the following: testdb1.schema1.seq1,testdb2.schema2.seq* If unset, access control is managed for all sequences.
SNOWFLAKE_MANAGE_FILE_FORMAT_LIST	string		No	Specifies a comma-separated list of file format names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of file formats might resemble the following: testdb1.schema1.fileFmtA,testdb2.schema2.fileFmt* If unset, access control is managed for all file formats.
SNOWFLAKE_MANAGE_PIPE_LIST	string		No	Specifies a comma-separated list of pipe names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of pipes might resemble the following: testdb1.schema1.pipeA,testdb2.schema2.pipe* If unset, access control is managed for all pipes.
SNOWFLAKE_MANAGE_EXTERNAL_STAGE_LIST	string		No	Specifies a comma-separated list of external stage names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of external stages might resemble the following: testdb1.schema1.externalStage1,testdb2.schema2.extStage* If unset, access control is managed for all external stages.
SNOWFLAKE_MANAGE_INTERNAL_STAGE_LIST	string		No	Specifies a comma-separated list of internal stages names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. An example list of internal stages might resemble the following: testdb1.schema1.internalStage1,testdb2.schema2.intStage* If unset, access control is managed for all internal stages.
SNOWFLAKE_IGNORE_WAREHOUSE_LIST	string		No	Specifies a comma-separated list of warehouse names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all warehouses are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_WAREHOUSE_LIST.
SNOWFLAKE_IGNORE_DATABASE_LIST	string	DEMO_DB,SNOWFLAKE,UTIL_DB,SNOWFLAKE_SAMPLE_DATA	No	Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all databases are subject to access control. For example: testdb1,testdb2,sales_db* This setting supersedes any values specified by SNOWFLAKE_MANAGE_DATABASE_LIST.
SNOWFLAKE_IGNORE_SCHEMA_LIST	string	*.INFORMATION_SCHEMA	No	Specifies a comma-separated list of schema names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all schemas are subject to access control. For example: testdb1.schema1,testdb2.schema2,sales_db*.sales* This setting supersedes any values specified by SNOWFLAKE_MANAGE_SCHEMA_LIST.
SNOWFLAKE_IGNORE_TABLE_LIST	string		No	Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Specify tables using the following format: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> This setting supersedes any values specified by SNOWFLAKE_MANAGE_TABLE_LIST.
SNOWFLAKE_IGNORE_STREAM_LIST	string		No	Specifies a comma-separated list of stream names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all streams are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_STREAM_LIST.
SNOWFLAKE_IGNORE_FUNCTION_LIST	string		No	Specifies a comma-separated list of functions names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all functions are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_FUNCTION_LIST.
SNOWFLAKE_IGNORE_PROCEDURE_LIST	string		No	Specifies a comma-separated list of procedures names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all procedures are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_PROCEDURE_LIST.
SNOWFLAKE_IGNORE_SEQUENCE_LIST	string		No	Specifies a comma-separated list of sequences names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all sequences are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_SEQUENCE_LIST.
SNOWFLAKE_IGNORE_FILE_FORMAT_LIST	string		No	Specifies a comma-separated list of file format names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all file formats are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_FILE_FORMAT_LIST.
SNOWFLAKE_IGNORE_PIPE_LIST	string		No	Specifies a comma-separated list of pipes names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all pipes are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_PIPE_LIST.
SNOWFLAKE_IGNORE_EXTERNAL_STAGE_LIST	string		No	Specifies a comma-separated list of external stage names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all external stages are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_EXTERNAL_STAGE_LIST.
SNOWFLAKE_IGNORE_INTERNAL_STAGE_LIST	string		No	Specifies a comma-separated list of internal stage names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all internal stages are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_INTERNAL_STAGE_LIST.

User, group, and role creation

Name	Type	Default	Required	Description
SNOWFLAKE_CREATE_USER	boolean	true	No	Specifies whether PolicySync creates local users for each user in Privacera.
SNOWFLAKE_CREATE_USER_ROLE	boolean	true	No	Specifies whether PolicySync creates local roles for each user in Privacera.
SNOWFLAKE_USER_LOGIN_NAME_USE_EMAIL	boolean	false	No	Specifies whether PolicySync uses the user email address as the login name when creating a new user in Snowflake.
SNOWFLAKE_DEFAULT_USER_PASSWORD	string		Yes	Specifies the password to use when PolicySync creates new users.
SNOWFLAKE_ENTITY_ROLE_PREFIX	string	priv_	No
SNOWFLAKE_USER_ROLE_PREFIX	string		No	Specifies the prefix that PolicySync uses when creating local users. For example, if you have a user named <USER> defined in Privacera and the role prefix is priv_user_, the local role is named priv_user_<USER>.
SNOWFLAKE_GROUP_ROLE_PREFIX	string		No	Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.
SNOWFLAKE_ROLE_ROLE_PREFIX	string		No	Specifies the prefix that PolicySync uses when creating roles from Privacera in the Snowflake data source. For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.
SNOWFLAKE_MANAGE_ENTITIES	boolean	true	No
SNOWFLAKE_MANAGE_USERS	boolean		No	Specifies whether PolicySync maintains user membership in roles in the Snowflake data source.
SNOWFLAKE_MANAGE_GROUPS	boolean		No	Specifies whether PolicySync creates groups from Privacera in the Snowflake data source.
SNOWFLAKE_MANAGE_ROLES	boolean		No	Specifies whether PolicySync creates roles from Privacera in the Snowflake data source.
SNOWFLAKE_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, SNOWFLAKE_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
SNOWFLAKE_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, SNOWFLAKE_IGNORE_GROUP_LIST takes precedence over this setting.
SNOWFLAKE_MANAGE_ROLE_LIST	string		No	Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: role1,role2,dev_role*. If specified, SNOWFLAKE_IGNORE_ROLE_LIST takes precedence over this setting.
SNOWFLAKE_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_USER_LIST.
SNOWFLAKE_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_GROUP_LIST.
SNOWFLAKE_IGNORE_ROLE_LIST	string		No	Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all roles are subject to access control. This setting supersedes any values specified by SNOWFLAKE_MANAGE_ROLE_LIST.
SNOWFLAKE_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the SNOWFLAKE_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
SNOWFLAKE_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the SNOWFLAKE_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
SNOWFLAKE_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the SNOWFLAKE_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
SNOWFLAKE_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the SNOWFLAKE_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
SNOWFLAKE_ROLE_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the SNOWFLAKE_ROLE_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
SNOWFLAKE_ROLE_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the SNOWFLAKE_ROLE_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
SNOWFLAKE_USER_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.
SNOWFLAKE_GROUP_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.
SNOWFLAKE_ROLE_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to true, case sensitivity is preserved.
SNOWFLAKE_USER_NAME_CASE_CONVERSION	string	lower	No	Specifies how user name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if SNOWFLAKE_USER_NAME_PERSIST_CASE_SENSITIVITY is set to true.
SNOWFLAKE_GROUP_NAME_CASE_CONVERSION	string	lower	No	Specifies how group name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if SNOWFLAKE_GROUP_NAME_PERSIST_CASE_SENSITIVITY is set to true.
SNOWFLAKE_ROLE_NAME_CASE_CONVERSION	string	lower	No	Specifies how role name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if SNOWFLAKE_ROLE_NAME_PERSIST_CASE_SENSITIVITY is set to true.
SNOWFLAKE_USER_FILTER_WITH_EMAIL	boolean	false	No	Set this property to true if you only want to manage users who have an email address associated with them in the portal.
SNOWFLAKE_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by SNOWFLAKE_MANAGE_GROUP_LIST. The default value is false.
SNOWFLAKE_MANAGE_USER_FILTERBY_ROLE	boolean	false	No	Specifies whether to manage only users that are members of the roles specified by SNOWFLAKE_MANAGE_ROLE_LIST. The default value is false.
SNOWFLAKE_USER_ROLE_USE_UPPERCASE	boolean	false	No	Specifies whether PolicySync converts a user role name to uppercase when performing operations.
SNOWFLAKE_GROUP_ROLE_USE_UPPERCASE	boolean	false	No	Specifies whether PolicySync converts a group name to uppercase when performing operations.
SNOWFLAKE_ROLE_ROLE_USE_UPPERCASE	boolean	false	No	Specifies whether PolicySync converts a role name to uppercase when performing operations.

Grant updates

Name	Type	Default	Required	Description
SNOWFLAKE_GRANT_UPDATES	boolean	true	No	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.
	string		No	Specifies whether PolicySync applies grants and revokes in batches. If enabled, this behavior improves overall performance of applying permission changes.
SNOWFLAKE_GRANT_UPDATES_MAX_RETRY_ATTEMPTS	integer	2	No	Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is 2.
SNOWFLAKE_ENABLE_PRIVILEGES_BATCHING	boolean	false	No	Specifies whether PolicySync applies privileges described in Access Manager policies.

Column level access control

Name	Type	Default	Required	Description
SNOWFLAKE_ENABLE_COLUMN_ACCESS_EXCEPTION	boolean	true	No	Specifies whether an access denied exception is displayed if a user does not have access to a table column and attempts to access that column. If enabled, you must set SNOWFLAKE_ENABLE_MASKING to true.

Native masking

Name	Type	Default	Required	Description
SNOWFLAKE_ENABLE_MASKING	boolean	true	No	Specifies whether PolicySync enables native masking policy creation functionality.
SNOWFLAKE_MASKING_POLICY_DB_NAME	string		No	Specifies the name of the database where PolicySync creates custom masking policies.
SNOWFLAKE_MASKING_POLICY_SCHEMA_NAME	string	PUBLIC	No	Specifies the name of the schema where PolicySync creates all native masking policies. If not specified, the resource schema is used as the masking policy schema.
SNOWFLAKE_MASKING_POLICY_NAME_TEMPLATE	string	{database}{separator}{schema}{separator}{table}	No	Specifies a naming template that PolicySync uses when creating native masking policies. For example, given the following values: {database}: customer_db {schema}: customer_schema {table}: customer_data {separator} _priv_ With the default naming template, the following name is used when creating a native masking policy. The {column} field is replaced by the column name. customer_db_priv_customer_schema_priv_customer_data_{column}

Native row filter

Name	Type	Default	Required	Description
SNOWFLAKE_ENABLE_ROW_FILTER	boolean	true	No	Specifies whether to use the data source native row filter functionality. This setting is disabled by default. When enabled, you can create row filters only on tables, but not on views.
SNOWFLAKE_ROW_FILTER_POLICY_DB_NAME	string		No	Specifies the name of the database where PolicySync creates native row-filter policies. If not specified, the resource database is considered the same as the row-filter policy database.
SNOWFLAKE_ROW_FILTER_POLICY_SCHEMA_NAME	string	PUBLIC	No	Specifies the name of the schema where PolicySync creates all native row-filter policies. If not specified, the resource schema is considered the same as the row-filter policy schema.
SNOWFLAKE_ROW_FILTER_POLICY_NAME_TEMPLATE	string	{database}{separator}{schema}{separator}{table}	No	Specifies a template for the name that PolicySync uses when creating a row filter policy. For example, given a table data from the schema schema that resides in the db database, the row filter policy name might resemble the following: db_priv_schema_priv_data_<ROW_FILTER_ITEM_NUMBER>

View based masking/row filter

Name	Type	Default	Required	Description
SNOWFLAKE_ENABLE_VIEW_BASED_ROW_FILTER	boolean	false	No	Specifies whether to use secure view based row filtering. The default value is false. While Snowflake supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
SNOWFLAKE_ENABLE_VIEW_BASED_MASKING	boolean	false	No	Specifies whether to use secure view based masking. The default value is false.
SNOWFLAKE_SECURE_VIEW_SCHEMA_NAME_PREFIX	string		No	Specifies a prefix string to apply to a secure schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view schema name for a schema named example1 is dev_example1.
SNOWFLAKE_SECURE_VIEW_SCHEMA_NAME_POSTFIX	string		No	Specifies a postfix string to apply to a secure view schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a schema named example1 is example1_dev.
SNOWFLAKE_SECURE_VIEW_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.
SNOWFLAKE_SECURE_VIEW_NAME_POSTFIX	string	_SECURE	No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.
SNOWFLAKE_SECURE_VIEW_SCHEMA_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a schema name. For example, if a schema is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
SNOWFLAKE_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
SNOWFLAKE_SECURE_VIEW_CREATE_FOR_ALL	boolean	false	No	Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.

Masking/Row filter policy name separator

Name	Type	Default	Required	Description
SNOWFLAKE_POLICY_NAME_SEPARATOR	string	_PRIV_	No	Specifies a string to use as part of the name of native row filter and masking policies.
SNOWFLAKE_ROW_FILTER_ALIAS_TOKEN	string	obj	No	Specifies an identifier that PolicySync uses to identify columns from the main table and parse each correctly.

Masked Value for Masking

Name	Type	Default	Required	Description
SNOWFLAKE_MASKED_NUMBER_VALUE	integer	0	No	Specifies the default masking value for numeric column types.
SNOWFLAKE_MASKED_DOUBLE_VALUE	integer	0	No	Specifies the default masking value for DOUBLE column types.
SNOWFLAKE_MASKED_TEXT_VALUE	string	<MASKED>	No	Specifies the default masking value for text and string column types.
POLICYSYNC_V2_MASKED_DATE_VALUE	string		No	Specifies the default masking value for date column types.

PEG integration

Name	Type	Default	Required	Description
SNOWFLAKE_PEG_FUNCTION_DB	string		No	Specifies the name of the database where the PEG encryption functions reside.
SNOWFLAKE_PEG_FUNCTION_SCHEMA	string	public	No	Specifies the schema name where the PEG encryption functions reside.

Load sql queries from system config json file

Name	Type	Default	Required	Description
SNOWFLAKE_LOAD_RESOURCES_KEY	string	load_md_from_account_columns	No	Specifies how PolicySync loads resources from Snowflake. The following values are allowed: load_md: Load the resources using metadata queries. load_md_from_account_columns: Load resources by directly running SHOW QUERIES on the account. This mode is preferred when you want to manage an entire Snowflake account. load_md_from_database_columns: Load the resources by directly running SHOW QUERIES only on managed databases. This mode is preferred when you want to manage only a few databases.

Audit integration

Name	Type	Default	Required	Description
SNOWFLAKE_AUDIT_ENABLE	boolean	true	Yes	Specifies whether Privacera fetches access audit data from the data source.
SNOWFLAKE_ENABLE_AUDIT_SOURCE_SIMPLE	boolean	true	No	Specifies whether to enable simple auditing. When enabled, PolicySync gathers the following audit information from the database: RequestData (query text) AccessResult (execute status) AccessType (query type) User (username) ResourcePath (database_name.schema_name) EventTime (query time) AclEnforcer (connector name) If you enabled this setting, do not enable SNOWFLAKE_ENABLE_AUDIT_SOURCE_ADVANCE.
SNOWFLAKE_ENABLE_AUDIT_SOURCE_ADVANCE	boolean	false	No	Specifies whether to enable advanced auditing. When enabled, PolicySync gathers the following audit information from the database: AccessResult (execute status) AccessType (query type) User (username) ResourcePath (database_name.schema_name.column_names) EventTime (query time) AclEnforcer (connector name) If you enabled this setting, do not enable SNOWFLAKE_ENABLE_AUDIT_SOURCE_SIMPLE.
SNOWFLAKE_AUDIT_ENABLE_RESOURCE_FILTER	boolean		No	Specifies whether PolicySync filters access audit information by managed resources, such as databases, schemas, and so forth.
SNOWFLAKE_AUDIT_INITIAL_PULL_MINUTES	string	30	No	Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Snowflake.
SNOWFLAKE_AUDIT_SOURCE_ADVANCE_DB_NAME	string	PRIVACERA_ACCESS_LOGS_DB	No	Specifies the database that PolicySync retrieves access audits from. This setting applies only if you set SNOWFLAKE_ENABLE_AUDIT_SOURCE_ADVANCE to true.

Load intervals

Name	Type	Default	Required	Description
SNOWFLAKE_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
SNOWFLAKE_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
SNOWFLAKE_PERMISSION_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
SNOWFLAKE_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Miscellaneous

Name	Type	Default	Required	Description

Microsoft SQL Connector

JDBC configuration properties

Name	Type	Default	Required	Description
MSSQL_JDBC_URL	string		Yes	Specifies the JDBC URL for the Microsoft SQL Server connector. Use the following format for the JDBC string: jdbc:sqlserver://<JDBC_SQLSERVER_URL_WITH_PORT_NUMBER>
MSSQL_JDBC_USERNAME	string		Yes	Specifies the JDBC username to use.
MSSQL_JDBC_PASSWORD	string		Yes	Specifies the JDBC password to use.
MSSQL_MASTER_DB	string	master	Yes	Specifies the name of the JDBC master database that PolicySync establishes an initial connection to.
MSSQL_AUTHENTICATION_TYPE	string	SqlPassword	Yes	Specifies the authentication type for the database engine. The following types are supported: If the user specified by MSSQL_JDBC_USERNAME is a local user, specify: SqlPassword If the user specified by MSSQL_JDBC_USERNAME is a Microsoft Azure Active Directory user, specify: ActiveDirectoryPassword
MSSQL_DEFAULT_USER_PASSWORD	string		Yes	Specifies the password to use when PolicySync creates new users.
MSSQL_OWNER_ROLE	string		No	Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user. If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource. If a value is specified, the owner of the resource will be changed to the specified value. The following resource types are supported: Database Schemas Tables Views

Load keys and intervals

Name	Type	Default	Required	Description
MSSQL_LOAD_RESOURCES_KEY	string	load_from_database_columns	No	Specifies how PolicySync loads resources from Microsoft SQL Server. The following values are allowed: load_md: Load resources from Microsoft SQL Server with a top-down resources approach, that is, it first loads the databases and then the schemas followed by tables and its columns. load_from_database_columns: Load resources one by one for each resource type that is, it loads all databases first, then it loads all schemas in all databases, followed by all tables in all schemas and its columns. This mode is recommended since it is faster than the load mode.
MSSQL_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
MSSQL_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
MSSQL_PERMISSION_SYNC_INTERVAL	integer	540	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
MSSQL_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Resources management

Name	Type	Default	Required	Description
MSSQL_MANAGE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of databases might resemble the following: testdb1,testdb2,sales db*. If specified, MSSQL_IGNORE_DATABASE_LIST takes precedence over this setting.
MSSQL_MANAGE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a schema: <DATABASE_NAME>.<SCHEMA_NAME> If specified, MSSQL_IGNORE_SCHEMA_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all schemas are managed: <DATABASE_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all schemas. If set to none no schemas are managed.
MSSQL_MANAGE_TABLE_LIST	string		No	Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a table: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> If specified, MSSQL_IGNORE_TABLE_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all matched tables are managed: <DATABASE_NAME>.<SCHEMA_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all tables. If set to none no tables are managed.
MSSQL_IGNORE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all databases are subject to access control. For example: testdb1,testdb2,sales_db* This setting supersedes any values specified by MSSQL_MANAGE_DATABASE_LIST.
MSSQL_IGNORE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all schemas are subject to access control. For example: testdb1.schema1,testdb2.schema2,sales_db*.sales* This setting supersedes any values specified by MSSQL_MANAGE_SCHEMA_LIST.
MSSQL_IGNORE_TABLE_LIST	string		No	Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Specify tables using the following format: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> This setting supersedes any values specified by MSSQL_MANAGE_TABLE_LIST.

Users/Groups/Roles management

Name	Type	Default	Required	Description
MSSQL_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the MSSQL_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
MSSQL_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the MSSQL_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
MSSQL_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the MSSQL_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
MSSQL_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the MSSQL_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
MSSQL_ROLE_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the MSSQL_ROLE_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
MSSQL_ROLE_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the MSSQL_ROLE_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
MSSQL_USER_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.
MSSQL_GROUP_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.
MSSQL_ROLE_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to true, case sensitivity is preserved.
MSSQL_USER_NAME_CASE_CONVERSION	string	lower	No	Specifies how user name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if MSSQL_USER_NAME_PERSIST_CASE_SENSITIVITY is set to true.
MSSQL_GROUP_NAME_CASE_CONVERSION	string	lower	No	Specifies how group name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if MSSQL_GROUP_NAME_PERSIST_CASE_SENSITIVITY is set to true.
MSSQL_ROLE_NAME_CASE_CONVERSION	string	lower	No	Specifies how role name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if MSSQL_ROLE_NAME_PERSIST_CASE_SENSITIVITY is set to true.
MSSQL_USER_FILTER_WITH_EMAIL	string		No	Set this property to true if you only want to manage users who have an email address associated with them in the portal.
MSSQL_MANAGE_USERS	boolean	false	No	Specifies whether PolicySync maintains user membership in roles in the Microsoft SQL Server data source.
MSSQL_MANAGE_GROUPS	boolean	false	No	Specifies whether PolicySync creates groups from Privacera in the Microsoft SQL Server data source.
MSSQL_MANAGE_ROLES	boolean	false	No	Specifies whether PolicySync creates roles from Privacera in the Microsoft SQL Server data source.
MSSQL_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, MSSQL_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
MSSQL_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, MSSQL_IGNORE_GROUP_LIST takes precedence over this setting.
MSSQL_MANAGE_ROLE_LIST	string		No	Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: role1,role2,dev_role*. If specified, MSSQL_IGNORE_ROLE_LIST takes precedence over this setting.
MSSQL_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by MSSQL_MANAGE_USER_LIST.
MSSQL_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by MSSQL_MANAGE_GROUP_LIST.
MSSQL_IGNORE_ROLE_LIST	string		No	Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all roles are subject to access control. This setting supersedes any values specified by MSSQL_MANAGE_ROLE_LIST.
MSSQL_USER_ROLE_PREFIX	string	priv_user_	No	Specifies the prefix that PolicySync uses when creating local users. For example, if you have a user named <USER> defined in Privacera and the role prefix is priv_user_, the local role is named priv_user_<USER>.
MSSQL_GROUP_ROLE_PREFIX	string	priv_group_	No	Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.
MSSQL_ROLE_ROLE_PREFIX	string	priv_role_	No	Specifies the prefix that PolicySync uses when creating roles from Privacera in the Microsoft SQL Server data source. For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.
MSSQL_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether PolicySync uses the Microsoft SQL Server native public group for access grants whenever a policy refers to a public group. The default value is false.
MSSQL_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by MSSQL_MANAGE_GROUP_LIST. The default value is false.
MSSQL_MANAGE_USER_FILTERBY_ROLE	boolean	false	No	Specifies whether to manage only users that are members of the roles specified by MSSQL_MANAGE_ROLE_LIST. The default value is false.

Native Row filter

Name	Type	Default	Required	Description
MSSQL_ENABLE_ROW_FILTER	boolean	true	No	Specifies whether to use the data source native row filter functionality. This setting is disabled by default. When enabled, you can create row filters only on tables, but not on views.
MSSQL_ENABLE_VIEW_BASED_MASKING	boolean	true	No	Specifies whether to use secure view based masking. The default value is true.
MSSQL_ENABLE_VIEW_BASED_ROW_FILTER	boolean	false	No	Specifies whether to use secure view based row filtering. The default value is false. While Microsoft SQL Server supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
MSSQL_SECURE_VIEW_CREATE_FOR_ALL	boolean	false	No	Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.
MSSQL_MASKED_NUMBER_VALUE	integer	0	No	Specifies the default masking value for numeric column types.
MSSQL_MASKED_TEXT_VALUE	string	<MASKED>	No	Specifies the default masking value for text and string column types.
MSSQL_MASKED_DATE_VALUE	string	null	No	Specifies the default masking value for date column types.
MSSQL_SECURE_VIEW_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.
MSSQL_SECURE_VIEW_NAME_POSTFIX	string	_secure	No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.
MSSQL_SECURE_VIEW_SCHEMA_NAME_PREFIX	string		No	Specifies a prefix string to apply to a secure schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view schema name for a schema named example1 is dev_example1.
MSSQL_SECURE_VIEW_SCHEMA_NAME_POSTFIX	string		No	Specifies a postfix string to apply to a secure view schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a schema named example1 is example1_dev.
MSSQL_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
MSSQL_SECURE_VIEW_SCHEMA_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a schema name. For example, if a schema is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
MSSQL_GRANT_UPDATES	boolean	true	Yes	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.
MSSQL_GRANT_UPDATES_MAX_RETRY_ATTEMPTS	integer	2	No	Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is 2.
MSSQL_ENABLE_DATA_ADMIN	boolean	true	No	This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.

Access audits management

Name	Type	Default	Required	Description
MSSQL_AUDIT_ENABLE	boolean	false	Yes	Specifies whether Privacera fetches access audit data from the data source. If specified, you must specify a value for the MSSQL_AUDIT_STORAGE_URL setting.
MSSQL_AUDIT_STORAGE_URL	string		No	Specifies the URL for the audit logs provided by the Azure SQL Auditing service. For example: https://test.blob.core.windows.net/sqldbauditlogs/test
MSSQL_AUDIT_INITIAL_PULL_MINUTES	integer	30	No	Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Microsoft SQL Server.
MSSQL_AUDIT_LOAD_KEY	string	load	No	Specifies the method that PolicySync uses to load access audit information. The following values are valid: load: Use SQL queries
MSSQL_USER_LOAD_KEY	string	load	No	Specifies how PolicySync loads users from Microsoft SQL Server. The following values are valid: load load_db
MSSQL_EXTERNAL_USER_AS_INTERNAL	boolean	false	No	Specifies whether PolicySync creates local users for external users.
MSSQL_MANAGE_GROUP_POLICY_ONLY	boolean	false	No	Specifies whether access policies apply to only groups. If enabled, any policies that apply to users or roles are ignored.

PostgreSQL Connector

JDBC configuration

Name	Type	Default	Required	Description
POSTGRES_JDBC_URL	string		Yes	Specifies the JDBC URL for the PostgreSQL connector. Use the following format for the JDBC string: jdbc:postgresql://<PG_SERVER_HOST>:<PG_SERVER_PORT>
POSTGRES_JDBC_USERNAME	string		Yes	Specifies the JDBC username to use.
POSTGRES_JDBC_PASSWORD	string		Yes	Specifies the JDBC password to use.
POSTGRES_JDBC_DB	string	privacera_db	Yes	Specifies the name of the JDBC database to use.
POSTGRES_DEFAULT_USER_PASSWORD	string		Yes	Specifies the password to use when PolicySync creates new users.
POSTGRES_OWNER_ROLE	string		No	Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user. If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource. If a value is specified, the owner of the resource will be changed to the specified value. The following resource types are supported: Database Schemas Tables Views

Load keys and intervals

Name	Type	Default	Required	Description
POSTGRES_LOAD_RESOURCES_KEY	string	load_from_database_columns	No	Specifies how PolicySync loads resources from PostgreSQL. The following values are allowed: load_md: Load resources from PostgreSQL with a top-down resources approach, that is, it first loads the databases and then the schemas followed by tables and its columns. load_from_database_columns: Load resources one by one for each resource type that is, it loads all databases first, then it loads all schemas in all databases, followed by all tables in all schemas and its columns. This mode is recommended since it is faster than the load mode.
POSTGRES_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
POSTGRES_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
POSTGRES_PERMISSION_SYNC_INTERVAL	integer	540	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
POSTGRES_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Resources management

Name	Type	Default	Required	Description
POSTGRES_MANAGE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of databases might resemble the following: testdb1,testdb2,sales db*. If specified, POSTGRES_IGNORE_DATABASE_LIST takes precedence over this setting.
POSTGRES_MANAGE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a schema: <DATABASE_NAME>.<SCHEMA_NAME> If specified, POSTGRES_IGNORE_SCHEMA_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all schemas are managed: <DATABASE_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all schemas. If set to none no schemas are managed.
POSTGRES_MANAGE_TABLE_LIST	string		No	Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a table: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> If specified, POSTGRES_IGNORE_TABLE_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all matched tables are managed: <DATABASE_NAME>.<SCHEMA_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all tables. If set to none no tables are managed.
POSTGRES_IGNORE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all databases are subject to access control. For example: testdb1,testdb2,sales_db* This setting supersedes any values specified by POSTGRES_MANAGE_DATABASE_LIST.
POSTGRES_IGNORE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all schemas are subject to access control. For example: testdb1.schema1,testdb2.schema2,sales_db*.sales* This setting supersedes any values specified by POSTGRES_MANAGE_SCHEMA_LIST.
POSTGRES_IGNORE_TABLE_LIST	string		No	Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Specify tables using the following format: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> This setting supersedes any values specified by POSTGRES_MANAGE_TABLE_LIST.

Users/Groups/Roles management

Name	Type	Default	Required	Description
POSTGRES_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the POSTGRES_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
POSTGRES_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the POSTGRES_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
POSTGRES_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the POSTGRES_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
POSTGRES_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the POSTGRES_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
POSTGRES_ROLE_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the POSTGRES_ROLE_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
POSTGRES_ROLE_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the POSTGRES_ROLE_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
POSTGRES_USER_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.
POSTGRES_GROUP_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.
POSTGRES_ROLE_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to true, case sensitivity is preserved.
POSTGRES_USER_NAME_CASE_CONVERSION	string	lower	No	Specifies how user name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if POSTGRES_USER_NAME_PERSIST_CASE_SENSITIVITY is set to true.
POSTGRES_GROUP_NAME_CASE_CONVERSION	string	lower	No	Specifies how group name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if POSTGRES_GROUP_NAME_PERSIST_CASE_SENSITIVITY is set to true.
POSTGRES_ROLE_NAME_CASE_CONVERSION	string	lower	No	Specifies how role name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if POSTGRES_ROLE_NAME_PERSIST_CASE_SENSITIVITY is set to true.
POSTGRES_CREATE_USER	boolean	true	No	Specifies whether PolicySync creates local users for each user in Privacera.
POSTGRES_CREATE_USER_ROLE	boolean	true	No	Specifies whether PolicySync creates local roles for each user in Privacera.
POSTGRES_MANAGE_USERS	boolean	true	No	Specifies whether PolicySync maintains user membership in roles in the PostgreSQL data source.
POSTGRES_MANAGE_GROUPS	boolean	true	No	Specifies whether PolicySync creates groups from Privacera in the PostgreSQL data source.
POSTGRES_MANAGE_ROLES	boolean	true	No	Specifies whether PolicySync creates roles from Privacera in the PostgreSQL data source.
POSTGRES_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, POSTGRES_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
POSTGRES_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, POSTGRES_IGNORE_GROUP_LIST takes precedence over this setting.
POSTGRES_MANAGE_ROLE_LIST	string		No	Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: role1,role2,dev_role*. If specified, POSTGRES_IGNORE_ROLE_LIST takes precedence over this setting.
POSTGRES_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by POSTGRES_MANAGE_USER_LIST.
POSTGRES_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by POSTGRES_MANAGE_GROUP_LIST.
POSTGRES_IGNORE_ROLE_LIST	string		No	Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all roles are subject to access control. This setting supersedes any values specified by POSTGRES_MANAGE_ROLE_LIST.
POSTGRES_USER_ROLE_PREFIX	string	priv_user_	No	Specifies the prefix that PolicySync uses when creating local users. For example, if you have a user named <USER> defined in Privacera and the role prefix is priv_user_, the local role is named priv_user_<USER>.
POSTGRES_GROUP_ROLE_PREFIX	string	priv_group_	No	Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.
POSTGRES_ROLE_ROLE_PREFIX	string	priv_role_	No	Specifies the prefix that PolicySync uses when creating roles from Privacera in the PostgreSQL data source. For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.
POSTGRES_USE_NATIVE_PUBLIC_GROUP	boolean	true	No	Specifies whether PolicySync uses the PostgreSQL native public group for access grants whenever a policy refers to a public group. The default value is true.
POSTGRES_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by POSTGRES_MANAGE_GROUP_LIST. The default value is false.
POSTGRES_MANAGE_USER_FILTERBY_ROLE	boolean	false	No	Specifies whether to manage only users that are members of the roles specified by POSTGRES_MANAGE_ROLE_LIST. The default value is false.

Access control management

Name	Type	Default	Required	Description
POSTGRES_POLICY_NAME_SEPARATOR	string	_priv_	No	Specifies a string to use as part of the name of native row filter and masking policies.
POSTGRES_ROW_FILTER_POLICY_NAME_TEMPLATE	string	{database}{separator}{schema}{separator}{table}	No	Specifies a template for the name that PolicySync uses when creating a row filter policy. For example, given a table data from the schema schema that resides in the db database, the row filter policy name might resemble the following: db_priv_schema_priv_data_<ROW_FILTER_ITEM_NUMBER>
POSTGRES_ENABLE_ROW_FILTER	boolean	false	No	Specifies whether to use the data source native row filter functionality. This setting is disabled by default. When enabled, you can create row filters only on tables, but not on views.
POSTGRES_ENABLE_VIEW_BASED_MASKING	boolean	true	No	Specifies whether to use secure view based masking. The default value is true. Because PolicySync does not support native masking for PostgreSQL, enabling this setting is recommended.
POSTGRES_ENABLE_VIEW_BASED_ROW_FILTER	boolean	true	No	Specifies whether to use secure view based row filtering. The default value is true. While PostgreSQL supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
POSTGRES_SECURE_VIEW_CREATE_FOR_ALL	boolean	true	No	Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.
POSTGRES_MASKED_NUMBER_VALUE	integer	0	No	Specifies the default masking value for numeric column types.
POSTGRES_MASKED_TEXT_VALUE	string	<MASKED>	No	Specifies the default masking value for text and string column types.
POSTGRES_SECURE_VIEW_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.
POSTGRES_SECURE_VIEW_NAME_POSTFIX	string	_secure	No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.
POSTGRES_SECURE_VIEW_SCHEMA_NAME_PREFIX	string		No	Specifies a prefix string to apply to a secure schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view schema name for a schema named example1 is dev_example1.
POSTGRES_SECURE_VIEW_SCHEMA_NAME_POSTFIX	string		No	Specifies a postfix string to apply to a secure view schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a schema named example1 is example1_dev.
POSTGRES_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
POSTGRES_SECURE_VIEW_SCHEMA_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a schema name. For example, if a schema is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
POSTGRES_GRANT_UPDATES	boolean	true	No	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.
POSTGRES_GRANT_UPDATES_MAX_RETRY_ATTEMPTS	integer	2	No	Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is 2.
POSTGRES_ENABLE_DATA_ADMIN	boolean	true	No	This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.

Access audits management

Name	Type	Default	Required	Description
POSTGRES_AUDIT_ENABLE	boolean	false	Yes	Specifies whether Privacera fetches access audit data from the data source.
POSTGRES_AUDIT_EXCLUDED_USERS	string	POSTGRES_JDBC_USERNAME	No	Specifies a comma separated list of users to exclude when fetching access audits. For example: "user1,user2,user3".
POSTGRES_AUDIT_SOURCE	string	sqs	No	Specifies the source for audit information. The following values are supported: sqs gcp_pgaudit The default value is: sqs

AWS SQS Postgres audit properties

Name	Type	Default	Required	Description
POSTGRES_AWS_ACCESS_KEY	string		No	Specifies the Amazon Web Services (AWS) access key that PolicySync uses to create an IAM client role to access the SQS queue to retrieve access audit information. Specify this only if your deployment machine lacks an IAM role with the necessary permissions.
POSTGRES_AWS_SECRET_KEY	string		No	Specifies the Amazon Web Services (AWS) secret key that PolicySync uses to create an IAM client role to access the SQS queue to retrieve access audit information. Specify this only if your deployment machine lacks an IAM role with the necessary permissions.
POSTGRES_AWS_REGION	string	POSTGRES_AUDIT_SQS_QUEUE_REGION	No	Specifies the Amazon Web Services (AWS) SQS queue region.
POSTGRES_AUDIT_SQS_QUEUE_REGION	string	us-east-1	No	Specifies the Amazon Web Services (AWS) SQS queue region.
POSTGRES_AWS_SQS_QUEUE_ENDPOINT	string		No	Specifies the SQS endpoint URL on Amazon Web Services (AWS). You must specify this value if you use a private VPC in your AWS account that is not available on the Internet.
POSTGRES_AWS_SQS_QUEUE_NAME	string	POSTGRES_AUDIT_SQS_QUEUE_NAME	No	Specifies the Amazon Web Services (AWS) SQS queue name that PolicySync uses to retrieve access audit information.
POSTGRES_AWS_SQS_QUEUE_MAX_POLL_MESSAGES	integer	100	No	Specifies the number of messages to retrieve from the SQS queue at one time for audit information.

GCP PostgreSQL audit properties

Name	Type	Default	Required	Description
POSTGRES_GCP_AUDIT_SOURCE_INSTANCE_ID	string		No	Specifies the Google Cloud Platform SQL instance ID for the PostgreSQL server. PolicySync uses this instance ID for retrieving access audit information. The instance ID must be provided in the following formation: <PROJECT_ID>:<DB_INSTANCE_ID>
POSTGRES_OAUTH_PRIVATE_KEY_FILE_NAME	string	policysync-postgres-gcp-audit-service-account.json	No	Specifies the name of the JSON file that contains your service account credentials. This setting applies only to PostgreSQL on Google Cloud Platform.

Redshift Connector

JDBC configuration

Name	Type	Default	Required	Description
REDSHIFT_JDBC_URL	string		Yes	Specifies the JDBC URL for the Amazon Redshift connector.
REDSHIFT_JDBC_USERNAME	string		Yes	Specifies the JDBC username to use. For PolicySync to push policies to Amazon Redshift, this user must have superuser privileges.
REDSHIFT_JDBC_PASSWORD	string		Yes	Specifies the JDBC password to use.
REDSHIFT_JDBC_DB	string		Yes	Specifies the name of the JDBC database to use. PolicySync also uses the connection to this database to load metadata and create principals such as users and groups.
REDSHIFT_DEFAULT_USER_PASSWORD	string		Yes	Specifies the password to use when PolicySync creates new users. The password must meet the following requirements: It must be between 8 and 64 characters long. It must contain at least one uppercase letter, one lowercase letter, and one number. It can use any ASCII character with the ASCII codes 33–126 except: ', ", ,, /, or @
REDSHIFT_OWNER_ROLE	string		No	Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user. If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource. If a value is specified, the owner of the resource will be changed to the specified value. The following resource types are supported: Database Schemas Tables Views

Load keys and intervals

Name	Type	Default	Required	Description
REDSHIFT_LOAD_RESOURCES_KEY	string	load_from_database_columns	No	Specifies how PolicySync loads resources from Amazon Redshift. The following values are allowed: load_md: Load resources from Amazon Redshift with a top-down resources approach, that is, it first loads the databases and then the schemas followed by tables and its columns. load_from_database_columns: Load resources one by one for each resource type that is, it loads all databases first, then it loads all schemas in all databases, followed by all tables in all schemas and its columns. This mode is recommended since it is faster than the load mode.
REDSHIFT_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
REDSHIFT_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
REDSHIFT_PERMISSION_SYNC_INTERVAL	integer	540	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
REDSHIFT_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Resources management

Name	Type	Default	Required	Description
REDSHIFT_MANAGE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of databases might resemble the following: testdb1,testdb2,sales db*. If specified, REDSHIFT_IGNORE_DATABASE_LIST takes precedence over this setting.
REDSHIFT_MANAGE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a schema: <DATABASE_NAME>.<SCHEMA_NAME> If specified, REDSHIFT_IGNORE_SCHEMA_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all schemas are managed: <DATABASE_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all schemas. If set to none no schemas are managed.
REDSHIFT_MANAGE_TABLE_LIST	string		No	Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a table: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> If specified, REDSHIFT_IGNORE_TABLE_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all matched tables are managed: <DATABASE_NAME>.<SCHEMA_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all tables. If set to none no tables are managed.
REDSHIFT_IGNORE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all databases are subject to access control. For example: testdb1,testdb2,sales_db* This setting supersedes any values specified by REDSHIFT_MANAGE_DATABASE_LIST.
REDSHIFT_IGNORE_SCHEMA_LIST	string		No	Specifies a comma-separated list of schema names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all schemas are subject to access control. For example: testdb1.schema1,testdb2.schema2,sales_db*.sales* This setting supersedes any values specified by REDSHIFT_MANAGE_SCHEMA_LIST.
REDSHIFT_IGNORE_TABLE_LIST	string		No	Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Specify tables using the following format: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> This setting supersedes any values specified by REDSHIFT_MANAGE_TABLE_LIST.

Users/Groups/Roles management

Name	Type	Default	Required	Description
REDSHIFT_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the REDSHIFT_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
REDSHIFT_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the REDSHIFT_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
REDSHIFT_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the REDSHIFT_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
REDSHIFT_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the REDSHIFT_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
REDSHIFT_ROLE_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the REDSHIFT_ROLE_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
REDSHIFT_ROLE_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the REDSHIFT_ROLE_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
REDSHIFT_USER_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether Amazon Redshift supports case sensitivity for users. Because case sensitivity in Amazon Redshift is global, enabling this enables case sensitivity for users, groups, roles, and resources.
REDSHIFT_GROUP_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether Amazon Redshift supports case sensitivity for groups. Because case sensitivity in Amazon Redshift is global, enabling this enables case sensitivity for users, groups, roles, and resources.
REDSHIFT_ROLE_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether Amazon Redshift supports case sensitivity for roles. Because case sensitivity in Amazon Redshift is global, enabling this enables case sensitivity for users, groups, roles, and resources.
REDSHIFT_ENABLE_CASE_SENSITIVE_IDENTIFIER	boolean	false	No	Specifies whether Amazon Redshift preserves case for user, group, role, and resource names. By default, Amazon Redshift converts all user, group, role, and resource names to lowercase. If set to true, PolicySync enables case sensitivity on a per connection basis.
REDSHIFT_ENABLE_CASE_SENSITIVE_IDENTIFIER_QUERY	string	SET enable_case_sensitive_identifier=true;	No	Specifies a query for Amazon Redshift that enables case sensitivity per connection. If you enable REDSHIFT_ENABLE_CASE_SENSITIVE_IDENTIFIER, then this setting defines the query that PolicySync runs.
REDSHIFT_USER_NAME_CASE_CONVERSION	string	lower	No	Specifies how user name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if REDSHIFT_USER_NAME_PERSIST_CASE_SENSITIVITY is set to true.
REDSHIFT_GROUP_NAME_CASE_CONVERSION	string	lower	No	Specifies how group name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if REDSHIFT_GROUP_NAME_PERSIST_CASE_SENSITIVITY is set to true.
REDSHIFT_ROLE_NAME_CASE_CONVERSION	string	lower	No	Specifies how role name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if REDSHIFT_ROLE_NAME_PERSIST_CASE_SENSITIVITY is set to true.
REDSHIFT_CREATE_USER	boolean	true	No	Specifies whether PolicySync creates local users for each user in Privacera.
REDSHIFT_CREATE_USER_ROLE	boolean	true	No	Specifies whether PolicySync creates local roles for each user in Privacera.
REDSHIFT_MANAGE_USERS	boolean	true	No	Specifies whether PolicySync maintains user membership in roles in the Amazon Redshift data source.
REDSHIFT_MANAGE_GROUPS	boolean	true	No	Specifies whether PolicySync creates groups from Privacera in the Amazon Redshift data source.
REDSHIFT_MANAGE_ROLES	boolean	true	No	Specifies whether PolicySync creates roles from Privacera in the Amazon Redshift data source.
REDSHIFT_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, REDSHIFT_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
REDSHIFT_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, REDSHIFT_IGNORE_GROUP_LIST takes precedence over this setting.
REDSHIFT_MANAGE_ROLE_LIST	string		No	Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: role1,role2,dev_role*. If specified, REDSHIFT_IGNORE_ROLE_LIST takes precedence over this setting.
REDSHIFT_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by REDSHIFT_MANAGE_USER_LIST.
REDSHIFT_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by REDSHIFT_MANAGE_GROUP_LIST.
REDSHIFT_IGNORE_ROLE_LIST	string		No	Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all roles are subject to access control. This setting supersedes any values specified by REDSHIFT_MANAGE_ROLE_LIST.
REDSHIFT_USER_ROLE_PREFIX	string	priv_user_	No	Specifies the prefix that PolicySync uses when creating local users. For example, if you have a user named <USER> defined in Privacera and the role prefix is priv_user_, the local role is named priv_user_<USER>.
REDSHIFT_GROUP_ROLE_PREFIX	string	priv_group_	No	Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.
REDSHIFT_ROLE_ROLE_PREFIX	string	priv_role_	No	Specifies the prefix that PolicySync uses when creating roles from Privacera in the Amazon Redshift data source. For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.
REDSHIFT_USE_NATIVE_PUBLIC_GROUP	boolean	true	No	Specifies whether PolicySync uses the Amazon Redshift native public group for access grants whenever a policy refers to a public group. The default value is true.
REDSHIFT_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by REDSHIFT_MANAGE_GROUP_LIST. The default value is false.
REDSHIFT_MANAGE_USER_FILTERBY_ROLE	boolean	false	No	Specifies whether to manage only users that are members of the roles specified by REDSHIFT_MANAGE_ROLE_LIST. The default value is false.

Access control management

Name	Type	Default	Required	Description
REDSHIFT_ENABLE_VIEW_BASED_MASKING	boolean	true	No	Specifies whether to use secure view based masking. The default value is true.
REDSHIFT_ENABLE_VIEW_BASED_ROW_FILTER	boolean	true	No	Specifies whether to use secure view based row filtering. The default value is true. While Amazon Redshift supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
REDSHIFT_SECURE_VIEW_CREATE_FOR_ALL	boolean	true	No	Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.
REDSHIFT_MASKED_NUMBER_VALUE	integer	0	No	Specifies the default masking value for numeric column types.
REDSHIFT_MASKED_TEXT_VALUE	string	<MASKED>	No	Specifies the default masking value for text and string column types.
REDSHIFT_SECURE_VIEW_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.
REDSHIFT_SECURE_VIEW_NAME_POSTFIX	string	_secure	No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.
REDSHIFT_SECURE_VIEW_SCHEMA_NAME_PREFIX	string		No	Specifies a prefix string to apply to a secure schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view schema name for a schema named example1 is dev_example1.
REDSHIFT_SECURE_VIEW_SCHEMA_NAME_POSTFIX	string		No	Specifies a postfix string to apply to a secure view schema name. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a schema named example1 is example1_dev.
REDSHIFT_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
REDSHIFT_SECURE_VIEW_SCHEMA_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a schema name. For example, if a schema is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
REDSHIFT_GRANT_UPDATES	boolean	false	No	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is false.
REDSHIFT_GRANT_UPDATES_MAX_RETRY_ATTEMPTS	integer	2	No	Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is 2.
REDSHIFT_ENABLE_DATA_ADMIN	boolean	true	No	This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.

Access audits management

Name	Type	Default	Required	Description
REDSHIFT_AUDIT_ENABLE	boolean	false	No	Specifies whether Privacera fetches access audit data from the data source.
REDSHIFT_AUDIT_EXCLUDED_USERS	string	REDSHIFT_JDBC_USERNAME	No	Specifies a comma separated list of users to exclude when fetching access audits. For example: "user1,user2,user3".
REDSHIFT_AUDIT_INITIAL_PULL_MINUTES	integer	30	No	Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Amazon Redshift.

Databricks SQL

JDBC configuration properties

Name	Type	Default	Required	Description
DATABRICKS_SQL_ANALYTICS_JDBC_URL	string		Yes	Specifies the JDBC URL for the Databricks SQL connector. Use the following format for the JDBC URL: jdbc:spark://<WORKSPACE_URL>:443/<DATABASE>;transportMode=http;ssl=1;AuthMech=3;httpPath=/sql/1.0/endpoints/1234567890 The workspace URL and the database name are derived from your Databricks SQL configuration.
DATABRICKS_SQL_ANALYTICS_JDBC_USERNAME	string		Yes	Specifies the JDBC username to use.
DATABRICKS_SQL_ANALYTICS_JDBC_PASSWORD	string		Yes	Specifies the access token of the SQL endpoint to use.
DATABRICKS_SQL_ANALYTICS_JDBC_DB	string		Yes	Specifies the name of the JDBC database to use.
DATABRICKS_SQL_ANALYTICS_OWNER_ROLE	string		No	Specifies the role that owns the resources managed by PolicySync. You must ensure that this user exists as PolicySync does not create this user. If a value is not specified, resources are owned by the creating user. In this case, the owner of the resource will have all access to the resource. If a value is specified, the owner of the resource will be changed to the specified value. The following resource types are supported: Database Schemas Tables Views
DATABRICKS_SQL_ANALYTICS_HOST_URL	string		Yes	Specifies the base URL for the Databricks SQL instance.

Load keys and intervals

Name	Type	Default	Required	Description
DATABRICKS_SQL_ANALYTICS_LOAD_RESOURCES_KEY	string	load_like	No	Specifies how PolicySync loads resources from Databricks SQL. The following values are allowed: load_like: Default value for loading resources, to be used in production. load: Load resources from Databricks SQL with a top-down resources approach, that is, it first loads the database and then the schemas followed by tables and its columns. This mode is only for development purposes.
DATABRICKS_SQL_ANALYTICS_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
DATABRICKS_SQL_ANALYTICS_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
DATABRICKS_SQL_ANALYTICS_PERMISSION_SYNC_INTERVAL	integer	540	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
DATABRICKS_SQL_ANALYTICS_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Resources management

Name	Type	Default	Required	Description
DATABRICKS_SQL_ANALYTICS_MANAGE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names for which PolicySync manages access control. If unset, access control is managed for all databases. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of databases might resemble the following: testdb1,testdb2,sales db*. If specified, DATABRICKS_SQL_ANALYTICS_IGNORE_DATABASE_LIST takes precedence over this setting.
DATABRICKS_SQL_ANALYTICS_MANAGE_TABLE_LIST	string		No	Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. Use the following format when specifying a table: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> If specified, DATABRICKS_SQL_ANALYTICS_IGNORE_TABLE_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all matched tables are managed: <DATABASE_NAME>.<SCHEMA_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all tables. If set to none no tables are managed.
DATABRICKS_SQL_ANALYTICS_IGNORE_DATABASE_LIST	string		No	Specifies a comma-separated list of database names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all databases are subject to access control. For example: testdb1,testdb2,sales_db* This setting supersedes any values specified by DATABRICKS_SQL_ANALYTICS_MANAGE_DATABASE_LIST.
DATABRICKS_SQL_ANALYTICS_IGNORE_TABLE_LIST	string		No	Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Specify tables using the following format: <DATABASE_NAME>.<SCHEMA_NAME>.<TABLE_NAME> This setting supersedes any values specified by DATABRICKS_SQL_ANALYTICS_MANAGE_TABLE_LIST.

Users/Groups/Roles management

Name	Type	Default	Required	Description
DATABRICKS_SQL_ANALYTICS_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a user name and replaces each matching character with the value specified by the DATABRICKS_SQL_ANALYTICS_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the DATABRICKS_SQL_ANALYTICS_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the DATABRICKS_SQL_ANALYTICS_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the DATABRICKS_SQL_ANALYTICS_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the DATABRICKS_SQL_ANALYTICS_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the DATABRICKS_SQL_ANALYTICS_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_ROLE_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a role name and replaces each matching character with the value specified by the DATABRICKS_SQL_ANALYTICS_ROLE_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_ROLE_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the DATABRICKS_SQL_ANALYTICS_ROLE_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
DATABRICKS_SQL_ANALYTICS_USER_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.
DATABRICKS_SQL_ANALYTICS_GROUP_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.
DATABRICKS_SQL_ANALYTICS_ROLE_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts role names to lowercase when creating local roles. If set to true, case sensitivity is preserved.
DATABRICKS_SQL_ANALYTICS_USER_NAME_CASE_CONVERSION	string	lower	No	Specifies how user name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if DATABRICKS_SQL_ANALYTICS_USER_NAME_PERSIST_CASE_SENSITIVITY is set to true.
DATABRICKS_SQL_ANALYTICS_GROUP_NAME_CASE_CONVERSION	string	lower	No	Specifies how group name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if DATABRICKS_SQL_ANALYTICS_GROUP_NAME_PERSIST_CASE_SENSITIVITY is set to true.
DATABRICKS_SQL_ANALYTICS_ROLE_NAME_CASE_CONVERSION	string	lower	No	Specifies how role name conversions are performed. The following options are valid: lower: Convert to lowercase upper: Convert to uppercase none: Preserve case This setting applies only if DATABRICKS_SQL_ANALYTICS_ROLE_NAME_PERSIST_CASE_SENSITIVITY is set to true.
DATABRICKS_SQL_ANALYTICS_CREATE_USER	boolean	true	No	Specifies whether PolicySync creates local users for each user in Privacera.
DATABRICKS_SQL_ANALYTICS_MANAGE_USERS	boolean	true	No	Specifies whether PolicySync maintains user membership in roles in the Databricks SQL data source.
DATABRICKS_SQL_ANALYTICS_MANAGE_GROUPS	boolean	true	No	Specifies whether PolicySync creates groups from Privacera in the Databricks SQL data source.
DATABRICKS_SQL_ANALYTICS_MANAGE_ROLES	boolean	true	No	Specifies whether PolicySync creates roles from Privacera in the Databricks SQL data source.
DATABRICKS_SQL_ANALYTICS_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, DATABRICKS_SQL_ANALYTICS_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
DATABRICKS_SQL_ANALYTICS_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, DATABRICKS_SQL_ANALYTICS_IGNORE_GROUP_LIST takes precedence over this setting.
DATABRICKS_SQL_ANALYTICS_MANAGE_ROLE_LIST	string		No	Specifies a comma-separated list of role names for which PolicySync manages access control. If unset, access control is managed for all roles. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: role1,role2,dev_role*. If specified, DATABRICKS_SQL_ANALYTICS_IGNORE_ROLE_LIST takes precedence over this setting.
DATABRICKS_SQL_ANALYTICS_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by DATABRICKS_SQL_ANALYTICS_MANAGE_USER_LIST.
DATABRICKS_SQL_ANALYTICS_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by DATABRICKS_SQL_ANALYTICS_MANAGE_GROUP_LIST.
DATABRICKS_SQL_ANALYTICS_IGNORE_ROLE_LIST	string		No	Specifies a comma-separated list of role names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all roles are subject to access control. This setting supersedes any values specified by DATABRICKS_SQL_ANALYTICS_MANAGE_ROLE_LIST.
DATABRICKS_SQL_ANALYTICS_GROUP_ROLE_PREFIX	string	priv_group_	No	Specifies the prefix that PolicySync uses when creating local roles. For example, if you have a group named etl_users defined in Privacera and the role prefix is prefix_, the local role is named prefix_etl_users.
DATABRICKS_SQL_ANALYTICS_ROLE_ROLE_PREFIX	string	priv_role_	No	Specifies the prefix that PolicySync uses when creating roles from Privacera in the Databricks SQL data source. For example, if you have a role in Privacera named finance defined in Privacera and the role prefix is role_prefix_, the local role is named role_prefix_finance.
DATABRICKS_SQL_ANALYTICS_USE_NATIVE_PUBLIC_GROUP	boolean	true	No	Specifies whether PolicySync uses the Databricks SQL native public group for access grants whenever a policy refers to a public group. The default value is true.
DATABRICKS_SQL_ANALYTICS_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by DATABRICKS_SQL_ANALYTICS_MANAGE_GROUP_LIST. The default value is false.
DATABRICKS_SQL_ANALYTICS_MANAGE_USER_FILTERBY_ROLE	boolean	false	No	Specifies whether to manage only users that are members of the roles specified by DATABRICKS_SQL_ANALYTICS_MANAGE_ROLE_LIST. The default value is false.
DATABRICKS_SQL_ANALYTICS_USER_USE_EMAIL_AS_SERVICE_NAME	boolean	true	No	This Property is used to map the username to the email address when granting/revoking access.

Access control management

Name	Type	Default	Required	Description
DATABRICKS_SQL_ANALYTICS_ENABLE_VIEW_BASED_MASKING	boolean	true	No	Specifies whether to use secure view based masking. The default value is true.
DATABRICKS_SQL_ANALYTICS_ENABLE_VIEW_BASED_ROW_FILTER	boolean	true	No	Specifies whether to use secure view based row filtering. The default value is true. While Databricks SQL supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_CREATE_FOR_ALL	boolean	true	No	Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.
DATABRICKS_SQL_ANALYTICS_MASKED_NUMBER_VALUE	integer	0	No	Specifies the default masking value for numeric column types.
DATABRICKS_SQL_ANALYTICS_MASKED_TEXT_VALUE	string	<MASKED>	No	Specifies the default masking value for text and string column types.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_NAME_POSTFIX	string		No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same schema name as the table schema name. If you want to change the secure view schema name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_DATABASE_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same name as the table database name. For example, if the prefix is priv_, then the secure view name for a database named example1 is priv_example1.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_DATABASE_NAME_POSTFIX	string	_secure	No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same name as the table database name. For example, if the postfix is _sec, then the secure view name for a database named example1 is example1_sec.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
DATABRICKS_SQL_ANALYTICS_SECURE_VIEW_DATABASE_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a database name. For example, if the database is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
DATABRICKS_SQL_ANALYTICS_GRANT_UPDATES	boolean	true	Yes	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.
DATABRICKS_SQL_ANALYTICS_ENABLE_DATA_ADMIN	boolean	true	No	This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.
DATABRICKS_SQL_ANALYTICS_USE_HIVE_ACCESS_POLICIES	boolean	false	No	Uncomment and set this property to true to use the privacera_hive service instead of privacera_databricks_sql_analytics. After setting the Privacera Manager property, PolicySync starts syncing the policies from the privacera_hive service. Be aware that deny and exclude polices from privacera_hive will not work, as only allow policies from Hive are supported this way.

Access audits management

Name	Type	Default	Required	Description
DATABRICKS_SQL_ANALYTICS_AUDIT_ENABLE	boolean	true	Yes	Specifies whether Privacera fetches access audit data from the data source.
DATABRICKS_SQL_ANALYTICS_AUDIT_INITIAL_PULL_MINUTES	integer	30	No	Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Databricks SQL.
DATABRICKS_SQL_ANALYTICS_AUDIT_EXCLUDED_USERS	string	{{DATABRICKS_SQL_ANALYTICS_JDBC_USERNAME}}	No	Specifies a comma separated list of users to exclude when fetching access audits. For example: "user1,user2,user3".

Google BigQuery Connector

JDBC configuration properties

Name	Type	Default	Required	Description
BIGQUERY_PROJECT_LOCATION	string	us	Yes	Specifies the geographical region where the taxonomy for the PolicySync should be created.
BIGQUERY_PROJECT_ID	string		Yes	Specifies the Google project ID where your Google BigQuery data source resides. For example: privacera-demo-project.
BIGQUERY_JDBC_URL	string	jdbc:bigquery://https://www.googleapis.com/bigquery/v2:443	No	Specifies the JDBC URL for the Google BigQuery connector.
BIGQUERY_USE_VM_CREDENTIALS	boolean	false	No	Specifies whether the PolicySync uses the service account attached to your virtual machine for the credentials to connect to the data source. When set to true you do not need to specify a value for BIGQUERY_OAUTH_PRIVATE_KEY_PATH.
BIGQUERY_OAUTH_SERVICE_ACCOUNT_EMAIL	string		Yes	Specifies the service account email address that PolicySync uses. You must specify this value if you are not using a Google Cloud Platform (GCP) virtual machine attached service account.
BIGQUERY_OAUTH_PRIVATE_KEY_PATH	string	/workdir/policysync/cust_conf/policysync-gbq-service-account.json	Yes	Specifies the path of the service account credentials JSON file that you downloaded from your Google Cloud Platform (GCP) account. You must specify this property if BIGQUERY_USE_VM_CREDENTIALS is set to false.
BIGQUERY_OAUTH_PRIVATE_KEY_FILE_NAME	string		Yes	Specifies the name of the JSON file that contains your Google Cloud Platform service account credentials. If specified, this value is combined with BIGQUERY_OAUTH_PRIVATE_KEY_PATH to provide a full path to the credentials JSON file. If you specify BIGQUERY_OAUTH_PRIVATE_KEY_PATH then you must specify this value as well.

Custom IAM roles

Name	Type	Default	Required	Description
BIGQUERY_CREATE_CUSTOM_IAM_ROLES	boolean	true	No	Specifies whether PolicySync automatically creates custom IAM roles in your Google Cloud Platform project or organization for fine-grained access control (FGAC). If set to false, you must create all required custom IAM roles manually in your GCP project or organization. The default value is true.
BIGQUERY_CUSTOM_IAM_ROLES_SCOPE	string	project	No	Specifies whether PolicySync creates and uses custom IAM roles at the project or organizational level in Google Cloud Platform (GCP). The following values are allowed: project: Create and use custom IAM roles from each individual project level. org: Create and use custom IAM roles at the organizational level.
BIGQUERY_ORGANIZATION_ID	string		No	Specifies the Google Cloud Platform (GCP) organizational ID. Specify this only if you configured PolicySync to use custom IAM roles at the organizational level.
BIGQUERY_CUSTOM_IAM_ROLES_NAME_MAPPING	string		No	Specifies a list of mappings between PolicySync custom IAM role names and your custom role names. Use the following format when specifying your custom role names: <PRIVACERA_DEFAULT_ROLE_NAME_1>:<CUSTOM_ROLE_NAME_1> <PRIVACERA_DEFAULT_ROLE_NAME_2>:<CUSTOM_ROLE_NAME_2> The following is a list of the default custom role names: PrivaceraGBQProjectListRole PrivaceraGBQJobListRole PrivaceraGBQJobListAllRole PrivaceraGBQJobCreateRole PrivaceraGBQJobGetRole PrivaceraGBQJobUpdateRole PrivaceraGBQJobDeleteRole PrivaceraGBQDatasetCreateRole PrivaceraGBQDatasetGetMetadataRole PrivaceraGBQDatasetUpdateRole PrivaceraGBQDatasetDeleteRole PrivaceraGBQTableListRole PrivaceraGBQTableCreateRole PrivaceraGBQTableGetMetadataRole PrivaceraGBQTableQueryRole PrivaceraGBQTableExportRole PrivaceraGBQTableUpdateMetadataRole PrivaceraGBQTableUpdateRole PrivaceraGBQTableSetCategoryRole PrivaceraGBQTableDeleteRole PrivaceraGBQTransferUpdateRole PrivaceraGBQTransferGetRole

Load keys and intervals

Name	Type	Default	Required	Description
BIGQUERY_LOAD_RESOURCES_KEY	string	load_from_dataset_columns	No	Specifies how PolicySync loads resources from Google BigQuery. The following values are allowed: load_md: Load resources from Google BigQuery with a top-down resources approach, that is, it first loads the project and then the dataset followed by tables and its columns. load_from_dataset_columns: Load resources one by one for each resource type that is, it loads all projects first, then it loads all datasets in all projects, followed by all tables in all datasets and its columns. This mode is recommended since it is faster than the load mode.
BIGQUERY_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
BIGQUERY_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
BIGQUERY_PERMISSION_SYNC_INTERVAL	integer	540	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
BIGQUERY_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Resources management

Name	Type	Default	Required	Description
BIGQUERY_MANAGE_PROJECT_LIST	string		Yes	Specifies a comma-separated list of project names to which access control is managed by PolicySync. If unset, PolicySync manages all projects. If specified, use the following format. You can use wildcards. The list of projects to ignore takes precedence over any projects specified by this setting. An example list of projects might resemble the following: testproject1,testproject2,sales_project*.
BIGQUERY_MANAGE_DATASET_LIST	string		Yes	Specifies a list of comma-separated datasets that PolicySync manages access control to. You can use wildcards in the value. If you want to manage all datasets, do not set a value. For example: testproject1.dataset1,testproject2.dataset2,sales_project*.sales* You can configure the postfix by specifying BIGQUERY_SECURE_VIEW_DATASET_NAME_POSTFIX. If specified, the BIGQUERY_IGNORE_DATASET_LIST setting takes precedence over this setting.
BIGQUERY_MANAGE_TABLE_LIST	string		No	Specifies a comma-separated list of table names for which PolicySync manages access control. You can use wildcards. Use the following format when specifying a table: <PROJECT_NAME>.<DATASET_NAME>.<TABLE_NAME> If specified, BIGQUERY_IGNORE_TABLE_LIST takes precedence over this setting. If you specify a wildcard, such as in the following example, all matched tables are managed: <PROJECT_NAME>.<DATASET_NAME>.* The specified value, if any, is interpreted in the following ways: If unset, access control is managed for all datasets. If set to none no datasets are managed.
BIGQUERY_IGNORE_PROJECT_LIST	string		No	Specifies a comma-separated list of project names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all projects are subject to access control. For example: testproject1,testproject2,sales_project*. This setting supersedes any values specified by BIGQUERY_MANAGE_PROJECT_LIST.
BIGQUERY_IGNORE_DATASET_LIST	string		No	Specifies a comma-separated list of dataset names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all datasets are subject to access control. For example: testproject1.dataset1,testproject2.dataset2,sales_project*.sales*. This setting supersedes any values specified by BIGQUERY_MANAGE_DATASET_LIST.
BIGQUERY_IGNORE_TABLE_LIST	string		No	Specifies a comma-separated list of table names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all tables are subject to access control. Specify tables using the following format: <PROJECT_NAME>.<DATASET_NAME>.<TABLE_NAME> This setting supersedes any values specified by BIGQUERY_MANAGE_TABLE_LIST.

Users, groups, and roles management

Name	Type	Default	Required	Description
BIGQUERY_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the BIGQUERY_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
BIGQUERY_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the BIGQUERY_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
BIGQUERY_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the BIGQUERY_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
BIGQUERY_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the BIGQUERY_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
BIGQUERY_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, BIGQUERY_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
BIGQUERY_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, BIGQUERY_IGNORE_GROUP_LIST takes precedence over this setting.
BIGQUERY_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by BIGQUERY_MANAGE_USER_LIST.
BIGQUERY_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by BIGQUERY_MANAGE_GROUP_LIST.
BIGQUERY_NATIVE_PUBLIC_GROUP_IDENTITY_NAME	string		Yes	Set this property to your preferred value, policysync uses this native public group for access grants whenever there is policy created referring to public group inside it. The following values are allowed: ALL_AUTHENTICATED_USERS: All gcp project authenticated users. ALL_USERS: All google authenticated users.
BIGQUERY_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by BIGQUERY_MANAGE_GROUP_LIST. The default value is false.

Access control management

Name	Type	Default	Required	Description
BIGQUERY_COLUMN_ACCESS_CONTROL_TYPE	string	view	No	Specifies how PolicySync manages column-level access control. The following values are allowed: view: Use view-based column level access control. Any columns that a user cannot access appears as null in the secure view of the table or the secure view of the native view.
BIGQUERY_POLICY_NAME_SEPARATOR	string	_	No	Specifies a string to use as part of the name of native row filter and masking policies.
BIGQUERY_ROW_FILTER_POLICY_NAME_TEMPLATE	string	row_filter_item_	No	Specifies a template for the name that PolicySync uses when creating a row filter policy. For example, given a table data from the ds dataset that resides in the proj project, the row filter policy name might resemble the following: proj_priv_ds_priv_data_<ROW_FILTER_ITEM_NUMBER>
BIGQUERY_ENABLE_ROW_FILTER	boolean	false	No	Specifies whether to use the data source native row filter functionality. This setting is disabled by default. When enabled, you can create row filters only on tables, but not on views.
BIGQUERY_ENABLE_VIEW_BASED_MASKING	boolean	true	No	Specifies whether to use secure view based masking. The default value is true.
BIGQUERY_ENABLE_VIEW_BASED_ROW_FILTER	boolean	true	No	Specifies whether to use secure view based row filtering. The default value is true. While Google BigQuery supports native filtering, PolicySync provides additional functionality that is not available natively. Enabling this setting is recommended.
BIGQUERY_SECURE_VIEW_CREATE_FOR_ALL	boolean	true	No	Specifies whether to create secure views for all tables and views that are created by users. If enabled, PolicySync creates secure views for resources regardless of whether masking or filtering policies are enabled.

Access audits management

Name	Type	Default	Required	Description
BIGQUERY_MASKING_FUNCTIONS_DATASET	string	privacera_dataset	No	Specifies the name of the dataset where PolicySync creates custom masking functions.
BIGQUERY_MASKED_NUMBER_VALUE	integer	0	No	Specifies the masking value used for numeric data types.
BIGQUERY_MASKED_TEXT_VALUE	string	<MASKED>	No	Specifies the masking value used for text or string data types.
BIGQUERY_SECURE_VIEW_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same dataset name as the table dataset name. If you want to change the secure view dataset name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a table named example1 is dev_example1.
BIGQUERY_SECURE_VIEW_NAME_POSTFIX	string		No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same dataset name as the table dataset name. If you want to change the secure view dataset name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a table named example1 is example1_dev.
BIGQUERY_SECURE_VIEW_DATASET_NAME_PREFIX	string		No	Specifies a prefix string for secure views. By default view-based row filter and masking-related secure views have the same dataset name as the table dataset name. If you want to change the secure view dataset name prefix, specify a value for this setting. For example, if the prefix is dev_, then the secure view name for a dataset named example1 is dev_example1.
BIGQUERY_SECURE_VIEW_DATASET_NAME_POSTFIX	string	_secure	No	Specifies a postfix string for secure views. By default view-based row filter and masking-related secure views have the same dataset name as the table dataset name. If you want to change the secure view dataset name postfix, specify a value for this setting. For example, if the postfix is _dev, then the secure view name for a dataset named example1 is example1_dev.
BIGQUERY_SECURE_VIEW_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a table or view name. For example, if the table is named example_suffix you can remove the _suffix string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes.
BIGQUERY_SECURE_VIEW_DATASET_NAME_REMOVE_SUFFIX_LIST	string		No	Specifies a suffix to remove from a secure view dataset name. For example, if the dataset is named some_name_ds you can remove the _ds string. This transformation is applied before any custom prefix or postfix is applied. You can specify a single suffix or a comma separated list of suffixes, such as _raw,_qa,_prod.
BIGQUERY_AUTHORIZED_VIEW_ACL_UPDATER_INTERVAL	integer	10	No	Specifies the interval at which the authorized view ACLs updater thread updates the permissions in the dataset if any permission updates are pending.
BIGQUERY_GRANT_UPDATES	boolean	true	Yes	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.
BIGQUERY_GRANT_UPDATES_MAX_RETRY_ATTEMPTS	integer	2	No	Specifies the maximum number of attempts that PolicySync makes to execute a grant query if it is unable to do so successfully. The default value is 2.
BIGQUERY_GRANT_UPDATES_BATCH	boolean	true	No	Specifies whether PolicySync applies grants and revokes in batches. If enabled, this behavior improves overall performance of applying permission changes.
BIGQUERY_ENABLE_DATA_ADMIN	boolean	true	No	This property is used to enable the data admin feature. With this feature enabled you can create all the policies on native tables/views, and respective grants will be made on the secure views of those native tables/views. These secure views will have row filter and masking capability. In case you need to grant permission on the native tables/views then you can select the permission you want plus data admin in the policy. Then those permissions will be granted on both the native table/view as well as its secure view.
BIGQUERY_AUDIT_ENABLE	boolean	false	Yes	Specifies whether Privacera fetches access audit data from the data source.
BIGQUERY_AUDIT_EXCLUDED_USERS	string		No	Specifies a comma separated list of users to exclude when fetching access audits. For example: "user1,user2,user3".
BIGQUERY_AUDIT_PROJECT_ID	string		No	Specifies the project ID where Google BigQuery stores audit log data.
BIGQUERY_AUDIT_DATASET_NAME	string		No	Specifies the name of the dataset where Google BigQuery logs audit data. Privacera uses this data for running audit queries.
BIGQUERY_AUDIT_LOAD_MAX_INTERVAL_MINUTES	integer	30	No	Specifies the maximum interval, in minutes, for queries that retrieve access audit information to run.

Power BI Connector

Connection configuration related properties

Name	Type	Default	Required	Description
POWER_BI_USERNAME	string		Yes	Specifies the authentication username. If you do not specify this value, you must specify a secret for POWER_BI_CLIENT_SECRET.
POWER_BI_PASSWORD	string		Yes	Specifies the authentication password. If you do not specify this value, you must specify a secret for POWER_BI_CLIENT_SECRET.
POWER_BI_TENANT_ID	string		Yes	Specifies the tenant ID associated with your Microsoft Azure account.
POWER_BI_CLIENT_ID	string		Yes	Specifies the principal ID for authentication.
POWER_BI_CLIENT_SECRET	string		Yes	Specifies a client secret for authentication. If you do not specify this value, you must specify both POWER_BI_USERNAME and POWER_BI_PASSWORD.

Load keys and intervals

Name	Type	Default	Required	Description
POWER_BI_RESOURCE_SYNC_INTERVAL	integer	60	No	Specifies the interval in seconds for PolicySync to wait before checking for new resources or changes to existing resources.
POWER_BI_PRINCIPAL_SYNC_INTERVAL	integer	420	No	Specifies the interval in seconds for PolicySync to wait before reconciling principals with those in the data source, such as users, groups, and roles. When differences are detected, PolicySync updates the principals in the data source accordingly.
POWER_BI_PERMISSION_SYNC_INTERVAL	integer	540	No	Specifies the interval in seconds for PolicySync to wait before reconciling Apache Ranger access control policies with those in the data source. When differences are detected, PolicySync updates the access control permissions on data source accordingly.
POWER_BI_AUDIT_SYNC_INTERVAL	integer	30	No	Specifies the interval in seconds to elapse before PolicySync retrieves access audits and saves the data in Privacera.

Resources management

Name	Type	Default	Required	Description
POWER_BI_MANAGE_WORKSPACE_LIST	string		No	Specifies a comma-separated list of workspace names for which PolicySync manages access control. If unset, access control is managed for all workspaces. If specified, use the following format. You can use wildcards. An example list of workspaces might resemble the following: demo1,demo2,sales*. If specified, POWER_BI_IGNORE_WORKSPACE_LIST takes precedence over this setting.
POWER_BI_IGNORE_WORKSPACE_LIST	string		No	Specifies a comma-separated list of workspace names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all workspaces are subject to access control. This setting supersedes any values specified by POWER_BI_MANAGE_WORKSPACE_LIST.

Users/Groups/Roles management

Name	Type	Default	Required	Description
POWER_BI_USER_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a username and replaces each matching character with the value specified by the POWER_BI_USER_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
POWER_BI_USER_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the POWER_BI_USER_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
POWER_BI_GROUP_NAME_REPLACE_FROM_REGEX	string	[~`$&+:;=?@#|'<>.^*()_%\\\\[\\\\]!\\\\-\\\\/\\\\\\\\{}]	No	Specifies a regular expression to apply to a group and replaces each matching character with the value specified by the POWER_BI_GROUP_NAME_REPLACE_TO_STRING setting. If not specified, no find and replace operation is performed.
POWER_BI_GROUP_NAME_REPLACE_TO_STRING	string	_	No	Specifies a string to replace the characters matched by the regex specified by the POWER_BI_GROUP_NAME_REPLACE_FROM_REGEX setting. If not specified, no find and replace operation is performed.
POWER_BI_USER_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts user names to lowercase when creating local users. If set to true, case sensitivity is preserved.
POWER_BI_GROUP_NAME_PERSIST_CASE_SENSITIVITY	boolean	false	No	Specifies whether PolicySync converts group names to lowercase when creating local groups. If set to true, case sensitivity is preserved.
POWER_BI_MANAGE_USER_LIST	string		No	Specifies a comma-separated list of user names for which PolicySync manages access control. You can use wildcards. Names are case-sensitive. If not specified, PolicySync manages access control for all users. If specified, POWER_BI_IGNORE_USER_LIST takes precedence over this setting. An example user list might resemble the following: user1,user2,dev_user*.
POWER_BI_MANAGE_GROUP_LIST	string		No	Specifies a comma-separated list of group names for which PolicySync manages access control. If unset, access control is managed for all groups. If specified, use the following format. You can use wildcards. Names are case-sensitive. An example list of projects might resemble the following: group1,group2,dev_group*. If specified, POWER_BI_IGNORE_GROUP_LIST takes precedence over this setting.
POWER_BI_IGNORE_USER_LIST	string		No	Specifies a comma-separated list of user names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all users are subject to access control. This setting supersedes any values specified by POWER_BI_MANAGE_USER_LIST.
POWER_BI_IGNORE_GROUP_LIST	string		No	Specifies a comma-separated list of group names that PolicySync does not provide access control for. You can specify wildcards. If not specified, all groups are subject to access control. This setting supersedes any values specified by POWER_BI_MANAGE_GROUP_LIST.
POWER_BI_USER_FILTER_WITH_EMAIL	boolean	false	No	Set this property to true if you only want to manage users who have an email address associated with them in the portal.
POWER_BI_MANAGE_USER_FILTERBY_GROUP	boolean	false	No	Specifies whether to manage only the users that are members of groups specified by POWER_BI_MANAGE_GROUP_LIST. The default value is false.

Access control management

Name	Type	Default	Required	Description
POWER_BI_GRANT_UPDATES	boolean	true	No	Specifies whether PolicySync performs grants and revokes for access control and creates, updates, and deletes queries for users, groups, and roles. The default value is true.

Access audits management

Name	Type	Default	Required	Description
POWER_BI_AUDIT_ENABLE	boolean	false	Yes	Specifies whether Privacera fetches access audit data from the data source.
POWER_BI_AUDIT_INITIAL_PULL_MINUTES	integer	30	No	Specifies the initial delay, in minutes, before PolicySync retrieves access audits from Microsoft Power BI.