dishtikundra opened a new pull request, #1177: URL: https://github.com/apache/ranger/pull/1177
The Ranger-S3 plugin extends Ranger's authorization capabilities to Amazon S3 resources, enabling centralized access control, and policy management for S3 buckets and objects accessed through various big data ecosystem components. This shall facilitate the Hadoop and data platform teams in managing S3 resource access internally without continuous DevOps support. Ranger S3 service contains two types of S3 policies: 1. Bucket-Level Policies: ``` Resource format: bucket1/, bucket2/ Actions: s3:ListBucket Purpose: Allow users to list objects in bucket without accessing contents ``` 2. Object-Level Policies: ``` Resource format: bucket1/*, bucket/prefix/* Actions: s3:GetObject, s3:PutObject, s3:DeleteObject Purpose: Grant read/write/delete access to objects within buckets ```The user is required to create separate policies for buckets and objects with respective permissions. Additionally, the plugin supports bi-directional sync between Ranger and IAM resource-based policy, with permissions set in Ranger taking precedence. Bi-directional sync here states that if IAM has additional users for given resource, changes in Ranger will be appended in existing policy at the IAM end. Additional users will not be visible on Ranger UI. If IAM resource-based policy has certain permissions to a user, and permissions are changed from Ranger UI for same user, then Ranger permissions shall be overwritten onto the resource-based policy in IAM. The resultant statements in IAM policies shall be applied when Hadoop services access respective S3 resource (s). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
