Using CLI

Learn how to create a resource policy in Ranger to grant the Assume_Role permissions for the user using CLI.

Ensure that you have the Administrator user name and password for Ranger.

Open a terminal on your device.

Run the following curl command to create a resource policy in Ranger to grant the Assume_Role permissions for the user:

curl -u [***RANGER_ADMIN_USERNAME***]:[***RANGER_ADMIN_PASSWORD***] \
 --include --location \
 --request POST \
  --header "Content-Type: application/json" \
  --header "accept: application/json" \
  --data '{
    "isEnabled": true,
    "service": "[***RANGER_SERVICE_NAME***]",
    "name": "[***POLICY_NAME***]",
    "policyType": 0,
    "policyPriority": 0,
    "isAuditEnabled": true,
    "resources": {
      "role": {
        "values": ["[***TARGET_ROLE_NAME***]"],
        "isExcludes": false,
        "isRecursive": false
      }
    },
    "policyItems": [
      {
        "accesses": [
          { "type": "assume_role", "isAllowed": true }
        ],
        "users": ["[***SERVICE_USER_NAME***]"],
        "delegateAdmin": false
      }
    ],
    "serviceType": "ozone",
    "isDenyAllElse": false
  }' \
  "[***RANGER_URL***]/service/public/v2/api/policy"

Example,

curl -u admin:Admin123 \
 --include --location \
 --request POST \
  --header "Content-Type: application/json" \
  --header "accept: application/json" \
    --data '{
    "isEnabled": true,
    "service": "cm_ozone",
    "name": "iceberg assume role policy",
    "policyType": 0,
    "policyPriority": 0,
    "isAuditEnabled": true,
    "resources": {
      "role": {
        "values": [
          "iceberg-data-all-access"
        ],
        "isExcludes": false,
        "isRecursive": false
      }
    },
    "policyItems": [
      {
        "accesses": [
          {
            "type": "assume_role",
            "isAllowed": true
          }
        ],
        "users": [
          "svc-iceberg-rest-catalog"
        ],
        "delegateAdmin": false
      }
    ],
    "serviceType": "ozone",
    "isDenyAllElse": false
  }' \
  "https://ranger-host.example.com:6182/service/public/v2/api/policy"