When loading unencrypted data into encrypted tables (e.g., LOAD DATA INPATH), we recommend placing the source data (to be encrypted) into a landing zone within the destination encryption zone.

An attempt to load data from one encryption zone into another will result in a copy operation. Distcp will be used to speed up the process if the size of the files being copied is higher than the value specified by the hive.exec.copyfile.maxsize property. The default limit is 32 MB.

To load unencrypted data into an encrypted table, use the LOAD DATA ... statement.

If the source data does not reside inside the encryption zone, the LOAD statement will result in a copy. If your data is already inside HDFS, though, you can use distcp to speed up the copying process.

If the data is already inside a Hive table, create a new table with a LOCATION inside an encryption zone, as follows:

CREATE TABLE encrypted_table [STORED AS] LOCATION ... AS SELECT * FROM <unencrypted_table>

	Note
	The location specified in the CREATE TABLE statement must be within an encryption zone. If you create a table that points LOCATION to an unencrypted directory, your data will not be encrypted. You must copy your data to an encryption zone, and then point LOCATION to that encryption zone.

LOCALSCRATCHDIR : The MapJoin optimization in Hive writes HDFS tables to a local directory and then uploads them to distributed cache. To enable encryption, either disable MapJoin (set hive.auto.convert.join to false) or encrypt the local Hive Scratch directory (hive.exec.local.scratchdir). Performance note: disabling MapJoin will result in slower join performance.

DOWNLOADED_RESOURCES_DIR: Jars that are added to a user session and stored in HDFS are downloaded to hive.downloaded.resources.dir. If you want these Jar files to be encrypted, configure hive.downloaded.resources.dir to be part of an encryption zone. This directory needs to be accessible to the HiveServer2.

NodeManager Local Directory List: Hive stores Jars and MapJoin files in the distributed cache, so if you'd like to use MapJoin or encrypt Jars and other resource files, the YARN configuration property NodeManager Local Directory List (yarn.nodemanager.local-dirs) must be configured to a set of encrypted local directories on all nodes.

Alternatively, to disable MapJoin, set hive.auto.convert.join to false.

Users reading data from read-only encrypted tables must have access to a temp directory that is encrypted with at least as strong encryption as the table.

By default, temp data related to HDFS encryption is written to a staging directory identified by the hive-exec.stagingdir property created in the hive-site.xml file associated with the table folder.

As of HDP-2.6.0, Hive INSERT OVERWRITE queries require a Ranger URI policy to allow write operations, even if the user has write privilege granted through HDFS policy. To fix the failing Hive INSERT OVERWRITE queries:

When using encryption with Trash enabled, table deletion operates differently than the default trash mechanism. For more information see Delete Files from an Encryption Zone.