Privacera Platform

In AWS Console. Open IAM Services.

Click Roles on the left side navigation and then click Create role

Create Role: Choose a use case. Select 'EC2' use case. (This "Allows EC2 instances to call AWS services on 'your' behalf").

Click Next: Permissions to transition to the next wizard page.

Create Role: Attach permissions policies. Using Filter policies, search for the previously created policy (e.g. 'privacera_s3_all'). Select it, (click in the checkbox).

Click Next: Tags.

Create Role: Add tags. Optionally add a tag based on your enterprise resource tag standards. Click Next: Review.

Create Role: Review. Enter a Role name such as 'privacera_s3_role'. Click Create role.

Confirm the Role has been created by searching for it in the Role list.

In AWS Console. Open IAM Services.

Click Policies on the left side navigation and then click Create Policy.

Click on the JSON tab.

Select a Policy from the list below, copy and paste it into the JSON edit box in the AWS Create policy dialog. Click Review policy (at the bottom of the page).

Full S3 Access - All Buckets

                              {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DataServerS3FullAccess",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
        }
    ]
}

Limited S3 Access - Limited Buckets

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataServerS3Limited",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObjectAcl",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:DeleteObject",
        "s3:DeleteBucket",
        "s3:ListBucketMultipartUploads",
        "s3:GetBucketAcl",
        "s3:GetBucketPolicy",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload",
        "s3:GetBucketLocation",
        "s3:PutObjectAcl"
        ],
      "Resource": [
        "arn:aws:s3:::<PLEASE_ASSIGN_BUCKET_NAME_1>/*",
        "arn:aws:s3:::<PLEASE_ASSIGN_BUCKET_NAME_2>",
        "arn:aws:s3:::<PLEASE_ASSIGN_BUCKET_NAME_3>/*",
        "arn:aws:s3:::<PLEASE_ASSIGN_BUCKET_NAME_4>"
        ]
    },
    {
      "Sid": "DataServerS3ListAndCreateBucketAccess",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:HeadBucket",
        "s3:CreateBucket"
        ],
      "Resource": "*"
    }
  ]
}

DynamoDB Access

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataserverDynamoDBAccess",
      "Effect": "Allow",
      "Action": [
          "dynamodb:Query",
          "dynamodb:PutItem",
          "dynamodb:DeleteItem",
          "dynamodb:Scan",
          "dynamodb:UpdateItem",
          "dynamodb:CreateTable",
          "dynamodb:DescribeTable",
          "dynamodb:DeleteTable",
          "dynamodb:UpdateTable",
          "dynamodb:GetItem",
          "dynamodb:CreateBackup",
          "dynamodb:BatchGetItem",
          "dynamodb:BatchWriteItem",
          "dynamodb:TagResource",
          "dynamodb:UntagResource"
      ],
      "Resource": [
          "*"
      ]
    },
    {
      "Sid": "DataserverDynamoDBAccessListing",
      "Effect": "Allow",
      "Action": [
          "dynamodb:ListTables",
          "dynamodb:ListBackups"
      ],
      "Resource": "*"
    }
  ]
}

Kinesis Access

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ManageStreams",
      "Effect": "Allow",
      "Action": [
        "kinesis:PutRecord",
        "kinesis:DeleteStream",
        "kinesis:DescribeStreamSummary",
        "kinesis:CreateStream",
        "kinesis:GetShardIterator",
        "kinesis:GetRecords",
        "kinesis:DescribeStream",
        "kinesis:PutRecords",
        "kinesis:AddTagsToStream",
        "kinesis:DecreaseStreamRetentionPeriod",
        "kinesis:IncreaseStreamRetentionPeriod",
        "kinesis:ListTagsForStream",
        "kinesis:RemoveTagsFromStream",
        "kinesis:RegisterStreamConsumer",
        "kinesis:DeregisterStreamConsumer",
        "kinesis:DescribeStreamConsumer",
        "kinesis:ListStreamConsumers",
        "kinesis:DisableEnhancedMonitoring",
        "kinesis:EnableEnhancedMonitoring",
        "kinesis:UpdateShardCount",
        "kinesis:MergeShards",
        "kinesis:SplitShard",
        "kinesis:StartStreamEncryption",
        "kinesis:StopStreamEncryption",
        "kinesis:ListShards"
      ],
      "Resource": "*"
    },
    {
      "Sid": "KinesisListing",
      "Effect": "Allow",
      "Action": [
        "kinesis:ListStreams",
        "kinesis:DescribeLimits"
      ],
      "Resource": "*"
    }
  ]
}

Firehose Access (Requires IAM Policy and Trust Relationship

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataserverKinesisFirehoseAccess",
      "Effect": "Allow",
      "Action": [
        "firehose:DescribeDeliveryStream",
        "firehose:DeleteDeliveryStream",
        "firehose:PutRecord",
        "firehose:CreateDeliveryStream",
        "firehose:UpdateDestination"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataserverKinesisFirehoseListingAccess",
      "Effect": "Allow",
      "Action": "firehose:ListDeliveryStreams",
      "Resource": "*"
    },
    {
      "Sid": "DataserverKinesisFirehosePassRoleAccess",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:PassRole"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataserverKinesisFirehoseKinesisAccess",
      "Effect": "Allow",
      "Action": [
        "kinesis:GetShardIterator",
        "kinesis:DescribeStream",
        "kinesis:GetRecords"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataserverKinesisS3Access",
      "Effect": "Allow",
      "Action": [
          "s3:PutObject",
          "s3:CreateBucket",
          "s3:ListBucket"
      ],
      "Resource": "*"
    }]
}

Add a Trust Relationship for Role "privacera-access-role':

                              {
"Sid": "DataserverKinesisAssumeRole",
"Effect":"Allow",
"Principal":{
    "Service":"firehose.amazonaws.com"
},
"Action":"sts:AssumeRole"
}

Lamda Access

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataserverLambdaManagementAccess",
      "Effect": "Allow",
      "Action": [
          "lambda:CreateFunction",
          "lambda:InvokeFunction",
          "lambda:GetEventSourceMapping",
          "lambda:GetFunction",
          "lambda:DeleteFunction",
          "lambda:DeleteEventSourceMapping"
      ],
      "Resource": [
          "*"
      ]
    },
    {
      "Sid": "DataserverLambdaManagementListing",
      "Effect": "Allow",
      "Action": [
          "lambda:ListFunctions",
          "lambda:ListEventSourceMappings",
          "lambda:CreateEventSourceMapping"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataserverLambdaKinesisStreamRead",
        "Effect": "Allow",
        "Action": [
            "kinesis:SubscribeToShard",
            "kinesis:DescribeStreamSummary",
            "kinesis:GetShardIterator",
            "kinesis:GetRecords",
            "kinesis:DescribeStream"
        ],
      "Resource": "*"
    },
    {
      "Sid": "DataserverLambdaKinesisListing",
      "Effect": "Allow",
      "Action": [
          "kinesis:ListStreams",
          "kinesis:ListShards"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataserverLambdaS3BucketsListing",
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    }
  ]
}

Add a Trust Relationship for AWS IAM role 'privacera-access-role'

                              {
"Sid": "DataserverLambdaAssumeRole",
"Effect":"Allow",
"Principal":{
    "Service":"lambda.amazonaws.com"
},
"Action":"sts:AssumeRole"
}

Athena Access

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataServerAthenaAccess",
      "Effect": "Allow",
      "Action": [
        "athena:TagResource",
        "athena:UntagResource",
        "athena:StartQueryExecution",
        "athena:GetQueryResultsStream",
        "athena:DeleteWorkGroup",
        "athena:GetQueryResults",
        "athena:DeleteNamedQuery",
        "athena:UpdateWorkGroup",
        "athena:GetNamedQuery",
        "athena:CreateWorkGroup",
        "athena:ListTagsForResource",
        "athena:ListQueryExecutions",
        "athena:ListNamedQueries",
        "athena:GetWorkGroup",
        "athena:CreateNamedQuery",
        "athena:GetQueryExecution",
        "athena:StopQueryExecution",
        "athena:BatchGetNamedQuery",
        "athena:BatchGetQueryExecution"
      ],
      "Resource": [
        "arn:aws:athena:*:*:workgroup/primary"
      ]
    },
    {
      "Sid": "DataServerAthenaGlue",
      "Effect": "Allow",
      "Action": [
          "glue:CreateDatabase",
          "glue:DeleteDatabase",
          "glue:GetDatabase",
          "glue:GetDatabases",
          "glue:UpdateDatabase",
          "glue:CreateTable",
          "glue:DeleteTable",
          "glue:BatchDeleteTable",
          "glue:UpdateTable",
          "glue:GetTable",
          "glue:GetTables",
          "glue:BatchCreatePartition",
          "glue:CreatePartition",
          "glue:DeletePartition",
          "glue:BatchDeletePartition",
          "glue:UpdatePartition",
          "glue:GetPartition",
          "glue:GetPartitions",
          "glue:BatchGetPartition",
          "glue:GetCatalogImportStatus"
      ],
      "Resource": [
          "*"
      ]
    }
  ]
}

Glue Access

                              {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "glue:CreateDatabase",
        "glue:DeleteDatabase",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:UpdateDatabase",
        "glue:CreateTable",
        "glue:DeleteTable",
        "glue:BatchDeleteTable",
        "glue:UpdateTable",
        "glue:GetTable",
        "glue:GetTables",
        "glue:BatchCreatePartition",
        "glue:CreatePartition",
        "glue:DeletePartition",
        "glue:BatchDeletePartition",
        "glue:UpdatePartition",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:BatchGetPartition",
        "glue:GetCatalogImportStatus"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

In Create policy: Review Policy, give each policy a descriptive name, such as 'privacera_s3_all_policy', or 'privacera_s3_limited_policy'. Suggested practice is to use 'privacera_' as a prefix for each policy created for Privacera Manager or Privacera Platform.

Click Create policy at the bottom of the dialog.

If you are not already in the AWS console at IAM: Policies, open it now:

1. In AWS Console. Open IAM Services.

2. Click Policies on the left side navigation and then click Create Policy.

Locate the Policy(s) to be attached by searching for each by name in the Create Policy dialog. (Use a substring such as "privacera" to find all with this name prefix.)

Select a Policy to attach by clicking on the 'radio' button to the left of the policy name.

Click the Policy actions menu at the top of this dialog. Select Attach. This will open the Attach policy dialog.

Select the Privacera_PM_Role, and Attach Policy (at the bottom of the dialog). This will attach the policy to the Privacera_PM_Role, and those rights will be conveyed to the Privacera Manager Host virtual machine.

Configure event notification from S3 bucket to SQS Queue.

1. Login to AWS console and go to S3 service.

2. Navigate to your bucket which needs to be realtime scanned.

3. Under Properties tab, navigate to the Event Notifications section and choose Create event notification.

4. In the Event name, enter a name.

5. For real-time scanning - In the Event types section, select PUT, POST, COPY, Multipart upload completed, and All object delete events. You will receive notifications for these event types.

   For AWS S3 tag sync - In the Event types --> Object Tagging section, select Object tags added and Object tags deleted. You will receive notifications for these event types.

6. Select Destination type as SQS Queue, and then, from the dropdown list, choose the SQS queue. If SQS queue was auto-created by PM, then the name will be prefixed by privacera_bucket_sqs_ along with your environment name {{DEPLOYMENT_ENV_NAME}}.

7. Click Save Changes.

Related Information

Refer the AWS documentation for a detailed information on event notifications, click here.

Apply access policy in SQS Queue to allow S3 bucket to send events.

1. Navigate to SQS Queue and select the queue on which the access policy is to be applied.

2. Provide the correct Access Policy to SQS queue, so that S3 is allowed to put events into SQS queue. Refer to the following example to apply access policy:

      {"Version":"2012-10-17","Id":"arn:aws:sqs:{region_name}:{account_id}:{sqs_queue_name}/SQSDefaultPolicy","Statement":[{"Sid":"AllowS3Notify1","Effect":"Allow","Principal":{"AWS":"*"},"Action":"SQS:SendMessage","Resource":"arn:aws:sqs:{region_name}:{account_id}:{sqs_queue_name}","Condition":{"ArnLike":{"aws:SourceArn":"arn:aws:s3:*:*:{s3_bucket_to_be_scanned}"}}}]}
   

Related Information

Refer the AWS documentation for a detailed information on SQS access policy, click here.

SSH to instance as ${USER}.

Download and run the minio setup script.

sudo su
mkdir -p /tmp/downloads
cd /tmp/downloads
wget https://privacera.s3.amazonaws.com/public/run_minio.sh -O run_minio.sh
chmod a+x run_minio.sh
./run_minio.sh

Check the minio service is up and running.

docker ps | grep minio
exit

Open the minio browser. For example, http://192.468.12.412:9000/minio/

http://${MINIO SERVER HOST}:${MINIO SERVER PORT}/minio/

Enter the login credentials. Get the Access Key and Secret Key from your System Administrator.

login_id: ${MINIO_ACCESS_KEY} password: ${MINIO_SECRET_KEY}

Click button to create a new bucket. Give a name. For example, minio-s3-1.

The list of buckets is displayed on the left.

Login to AWS console and go to IAM service.

Click the Roles from left menu and then click the Create role.

In the role list, click on the newly created role. Now, let’s add an inline policy to the role. This policy grants access to the S3 bucket.

{
    "Version": "2012-10-17", "Statement": [
      {
        "Effect": "Allow", "Action": [
          "s3:ListBucket"
        ], "Resource": [
          "arn:aws:s3:::${s3_bucket_name}"
        ]
      }, {
        "Effect": "Allow", "Action": [
          "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:PutObjectAcl"
        ], "Resource": [
          "arn:aws:s3:::${s3_bucket_name}/*"
        ]
      }
    ]
  }

Click the Review Policy.

Enter the Policy name.

Click the Create policy.

In the role summary, copy the Instance Profile ARNs.

Login to AWS console and go to IAM service.

Click the Policies from left menu and then click the Create policy.

Click the JSON tab.

{
    "Version": "2012-10-17", "Statement": [
        {
            "Effect": "Allow", "Action": [
                "iam:PassRole"
            ], "Resource": "arn:aws:iam::xxxxxxxxxxxx:role/${iam_role_for_s3_access}"
        }
    ]
}

Click the Review pol icy.

Enter the Policy name.

Click the Create policy. Now attach this policy to IAM role which was used to create the Databricks instance.

Login to Databricks and click on top-right menu.

Click the Admin Console.

Click the IAM Roles tab.

Click the +Add IAM Role.

Enter the Instance Profile ARN which you have created in step 1 Create IAM Role and Policy to Access S3 Bucket

Databricks validates that this Instance Profile ARN is both syntactically and semantically correct. To validate semantic correctness, Databricks does a dry run by launching a cluster with this IAM role. Any failure in this dry run produces a validation error in the UI.

Click Add.

You can specify the users who can launch clusters with the IAM role. (Optional)

Login to Databricks and click the Clusters from left menu.

Select or create a cluster.

Expand the Advanced Options section, under Instances tab, select the IAM role from the IAM Role drop-down list. This drop-down includes all of the IAM roles that are available for the cluster.

Extract bucketName from the request.

Find the IAM Role to be assumed from the mapping property, DATASERVER_AWS_S3_MULTI_ACCOUNT_MAPPING.

SSH to EC2 instance where Privacera Dataserver is installed.

Enable multi-account access in Privacera Dataserver. Click the tab to reveal steps for Privacera Manager CLI and UI.

cd ~/privacera/privacera-manager
cp config/sample-vars/vars.dataserver.aws.yml config/custom-vars/
vi config/custom-vars/vars.dataserver.aws.yml

Add the new property.

DATASERVER_AWS_S3_MULTI_ACCOUNT_ACCESS_ENABLE:"true"
DATASERVER_AWS_S3_MULTI_ACCOUNT_DEFAULT_IAM:"<default-role-ARN>"
DATASERVER_AWS_S3_MULTI_ACCOUNT_MAPPING:-"<role-arn>|<bucketA,bucketB*>"-"<role-arn>|<bucketC*,bucketD>"

Note

Update Privacera Manager. Click the tab to reveal steps for Privacera Manager CLI and UI.

Run the following command.

cd ~/privacera/privacera-manager
./privacera-manager.sh update

Set assume role permission for Dataserver Instance Role in AWS console.

Each IAM Role which is added above needs to have trust on the IAM role attached to your Privacera Dataserver (e.g. arn:aws:iam::999999999999:role/PRIV_DATASERVER_ROLE).

In the Privacera Portal, click LaunchPad from the left menu.

Under the Azure Services section, click to open the Azure CLI dialog. This dialog provides the means to download an Azure CLI setup script specific to your installation. It also provides a set of usage instructions.

In Azure CLI, under Configure Script, click Download Script to save the script on your local machine. If you will be running Azure CLI on another system such as a 'jump server' copy it to that host.

1. Alternatively, use 'wget' to pull this script down to your execution platform, as shown below. Substitute your installation's Privacera Platform host domain name or IPv4 address for "<PRIVACERA_PORTAL_HOST>".

   wget http://<PRIVACERA_PORTAL_HOST>:6868/api/cam/download/script -O privacera_azure.sh
   # USE THE "--no-check-certificate" option for HTTPS - and remove the # below
   # wget --no-check-certificate https://<PRIVACERA_PORTAL_HOST>:6868/api/cam/download/script -O privacera_azure.sh
   

2. Copy the downloaded script to home directory.

   cp privacera_azure.sh ~/
   cd ~/
   

3. Set this file to be executable:

   chmod a+x . ~/privacera_azure.sh
   

Under the Azure Cli Generate Token section, first, generate a platform token.

1. Run the following command:

   . ~/privacera_azure.sh --config-token
   

2. Select/check Never Expired to generate a token that does not expire. Click Generate.

Enable the Proxy or the endpoint and run one of the two commands shown below.

. ~/privacera_azure.sh --enable-proxy

or:

. ~/privacera_azure.sh --enable-endpoint

Under the Check Status section, run the command below.

. ~/privacera_azure.sh --status

To disable both the proxy and the endpoint, under the Azure Access section, run the commands shown below.

. ~/privacera_azure.sh --disable-proxy
. ~/privacera_azure.sh --disable-endpoint

Within Azure Active Directory, create and register a new app under App Registrations.

1. For supported account types, select ‘Accounts in this organizational directory only (XXXXXXXXX)’

2. In Redirect URI drop-down, select “Public client”.

3. Value:urn:ietf:wg:oauth:2.0:oob

4. Click the Register.

   

Once the App is registered, click the Certificates & secrets.

Click the New client secret.

Note down the generated value of the client secret as this will not be visible later.

Go to Storage Accounts in Azure.

Select Account.

Access Control (IAM).

Click on Add and select Role Assignments from dropdown menu.

Role Assignment 1

1. Select Role as Owner.

2. Assign Access to as default (no change).

3. For “Select” use Azure application created above.

Role Assignment 2

1. Select Role as Storage Blob Data Contributor.

2. Assign Access to as default (no change).

3. For “Select” use Azure application created above.

Open Azure portal and go to the storage account and select a storage account.

In that storage account screen, select Overview, you get the RESOURCE_GROUP and SUBSCRIPTION_ID values.

Select Access Keys in the same screen to get STORAGE_ACCOUNT_NAME and STORAGE_SHAREDKEY.

Open Azure portal and go to the App Registration and select the application created. Select Overview to get TENANT_ID and CLIENT_ID.

On the same screen, select Certificates and Secrets and get the client secret key.

Destination to write logs from Sink: Following destination are available to write logs from Sink:

a. Cloud Storage

b. Pub/Sub Topic

c. Big Query

In this document, Pub/Sub Topic is considered as a destination for a Sink.

Create a Sink

Create Role "Sales_Role".

Create User "Emily" and make Emily part of the Sales_Role.

Login to your Databricks account.

After logging into your Databricks, go to SQL Analytics.

Go to Endpoints and click on New SQL Endpoint.

Create the endpoint as per your requirement as shown below.

After creating endpoint click on the endpoint connection details and note down the JDBC url for configuration with PolicySync.

Click on personal access token to create token.

Click on Generate New Token.

Put the name for the token and validity and click on Generate.

Copy the generated token. This is the JDBC password of the user when connecting from PolicySync, and the email ID of the user is the JDBC username.

Grant Admin privileges.

1. Go to Workspace.

2. To access the Admin Console, go to the top right of the workspace UI, click the

   

   user account icon, and select Admin Console.

3. In the Admin column, select the checkbox for the user.

Create a custom configuration file.

cd ~/privacera/privacera-manager
vi config/custom-properties/databricks-spark.conf

Now, you can use the file to add any custom spark properties. Just add the properties one below the other, and then save the file.

For example, you can add the following property and save the file.

"spark.databricks.delta.formatCheck.enabled"="false"

Run the following command.

cd ~/privacera/privacera-manager
./privacera-manager.sh update

Add the following two properties in vars.databricks.plugin.yml.

For example,

DATABRICKS_SQL_CLUSTER_POLICY_SPARK_CONF:
- Note: first spark conf
    key : "spark.hadoop.first.spark.test"
    value: "test1"
- Note: second spark first spark conf
    key: "spark.hadoop.first.spark.test2"
    value: "test2"
DATABRICKS_SCALA_CLUSTER_POLICY_SPARK_CONF:
- Note: first spark conf
    key : "spark.hadoop.first.spark.test"
    value: "test1"
- Note: second spark first spark conf
    key: "spark.hadoop.first.spark.test2"
    value: "test2"

To add custom properties with Java agent, add the following property in vars.databricks.plugin.yml.

For example,

DATABRICKS_SPARK_PLUGIN_AGENT_JAR: " -Dmy.custom.propery=test -javaagent:/databricks/jars/privacera-agent.jar"

Login to Privacera Portal.

On the Privacera home page, expand the Settings menu and click on Databricks Policies from left menu.

Click the +Create Policy.

Enter the Policy Name. (Mandatory)

Select the Users, Groups, IAM Role from the drop-down.

You can select multiple Users and Groups.

Enter the Additional JSON (If any). This will append with the existing JSON which will be fetched from backend.

Click Save.

The policy is created successfully.

Login to the Azure portal.

Search for Azure Key Vault.

Click +Add to create a new key vault as shown below:

After vault is created, from the left navigation, select the Overview section and note the Vault URI AZURE_KEYVAULT_URL.

To connect to the vault, we need to create an application registration through the app registration.

Register the application (e.g. rangerkmsdemo) as shown in the following example:

Click on the registered application and in the left menu, navigate to the Overview section.

Note the Application (client) ID which is the AZURE_CLIENT_ID for connecting.

In the application screen, click on Certificates & Secrets in the left menu.

Create a new client secret as shown in the example below:

The Client Secret as shown - the secret value is the AZURE_CLIENT_SECRET.

Next, go the key vault that was created in Step 3.

Select Access Policies> +Add Access Policy.

In the Add access policy screen, we need to set permissions to access the vault with the application that was created.

Select the Key permissions (mandatory), Secret permissions (optional), and Certificate permissions (optional).

For Select principal , select the application you created.

Go to Privacera/docker/ranger/kms/install.properties and change the following values:

AZURE_KEYVAULT_ENABLED=true
AZURE_KEYVAULT_SSL_ENABLED=false
AZURE_CLIENT_ID=(from step 3.3)
AZURE_CLIENT_SECRET=(from step 3.6)
#AZURE_AUTH_KEYVAULT_CERTIFICATE_PATH (mandatory field. Value can be None/dummy)
AZURE_AUTH_KEYVAULT_CERTIFICATE_PATH=/home/machine/Desktop/azureAuthCertificate/keyvault-MyCert.pfx  # Initialize below prop if your certificate file has any password
# AZURE_AUTH_KEYVAULT_CERTIFICATE_PASSWORD (mandatory field. Value can be None/dummy)
AZURE_AUTH_KEYVAULT_CERTIFICATE_PASSWORD=certPass AZURE_MASTERKEY_NAME=RangerMasterKey
# E.G. RSA, RSA_HSM, EC, EC_HSM, OCT
AZURE_MASTER_KEY_TYPE=RSA
# E.G. RSA_OAEP, RSA_OAEP_256, RSA1_5, RSA_OAEP
ZONE_KEY_ENCRYPTION_ALGO=RSA_OAEP
AZURE_KEYVAULT_URL=(from step 4 )

Restart Ranger KMS as follows:

cd ~/privacera/docker
./privacera_services restart ranger-kms

The master key is created when Ranger KMS is restarted. Verify that master key (name that is set in the properties) is created in the vault under Keys:

When the Client ID and Client certificate are added and the Ranger KMS is restarted, an error occurs in the KMS logs: ~/privacera/docker/logs/ranger/kms/.

Exit the container and restart Ranger KMS.