Cloudera Docs

Creating a resource policy for a bucket using CLI

Learn how to create a resource policy in Ranger to grant the permissions for a bucket using CLI.

Ensure that you have the Administrator user name and password for Ranger.
  1. Open a terminal on your device.
  2. Run the following curl command to create a resource policy in Ranger to grant the permissions for the bucket: 
    curl -u [***RANGER_ADMIN_USERNAME***]:[***RANGER_ADMIN_PASSWORD***] \
 --include --location \
 --request POST \
  --header "Content-Type: application/json" \
  --header "accept: application/json" \
  --data '{
    "isEnabled": true,
    "service": "[***RANGER_SERVICE_NAME***]",
    "name": "[***RANGER_POLICY_NAME***]",
    "policyType": 0,
    "policyPriority": 0,
    "isAuditEnabled": true,
    "resources": {
      "volume": {
        "values": ["[***VOLUME_NAME***]"],
        "isExcludes": false,
        "isRecursive": false
      },
      "bucket": {
        "values": ["[***BUCKET_NAME***]}"],
        "isExcludes": false,
        "isRecursive": false
      }
    },
    "policyItems": [
      {
        "accesses": [
          { "type": "all", "isAllowed": true }
        ],
        "roles": ["[***ROLE_NAME***]"],
        "conditions": [{ "type": "action-matches", "values": ["GetObject", "PutObject"] }],
        "delegateAdmin": false
      }
    ],
    "serviceType": "ozone",
    "isDenyAllElse": false
  }' \
  "[***RANGER_URL***]/service/public/v2/api/policy"

    Example,

    curl   -u admin:Admin123 \
  --location \
  --request POST \
  --header "Content-Type: application/json" \
  --header "accept: application/json" \
  --data '{
    "isEnabled": true,
    "service": "cm_ozone",
    "name": "iceberg bucket access",
    "policyType": 0,
    "policyPriority": 0,
    "isAuditEnabled": true,
    "resources": {
      "volume": {
        "values": ["s3v"],
        "isExcludes": false,
        "isRecursive": false
      },
      "bucket": {
        "values": ["iceberg"],
        "isExcludes": false,
        "isRecursive": false
      }
    },
    "policyItems": [
      {
        "accesses": [
          {
            "type": "all",
            "isAllowed": true
          }
        ],
        "roles": ["iceberg-data-all-access"],
        "conditions": [{ "type": "action-matches", "values": ["GetObject", "PutObject"] }],
        "delegateAdmin": false
      }
    ],
    "serviceType": "ozone",
    "isDenyAllElse": false
  }' \
  "https://ranger-host.example.com:6182/service/public/v2/api/policy"