Creating a resource policy for a volume using CLI

Learn how to create a resource policy in Ranger to grant the permissions for a volume using CLI.

Ensure that you have the Administrator user name and password for Ranger.

Open a terminal on your device.

Fetch current policy definition:

curl -u [***RANGER_ADMIN_USERNAME***]:[***RANGER_ADMIN_PASSWORD***] \
  --fail -H "accept: application/json" \
  "[***RANGER_URL***]/service/public/v2/api/service/[***RANGER_SERVICE_NAME***]/policy/[***POLICY_NAME***]" \
  > policy.json

Example,

curl -u admin:Admin123 \
  --fail -H "accept: application/json" \
  "https://ranger-host.example.com:6182/service/public/v2/api/service/cm_ozone/policy/S3_VOLUME_POLICY_FOR_OZONE_CANARY" \
  > policy.json

Append new role access rule to the policy JSON:

jq '.policyItems += [{
  "accesses": [
    {"type": "read", "isAllowed": true},
    {"type": "list", "isAllowed": true}
  ],
  "roles": ["[***ROLE_NAME***]"],
  "users": [],
  "groups": [],
  "conditions": [{ "type": "action-matches", "values": ["GetObject", "PutObject"] }],
  "delegateAdmin": false
}]' policy.json > policy.updated.json

Example,

jq '.policyItems += [{
  "accesses": [
    {"type": "read", "isAllowed": true},
    {"type": "list", "isAllowed": true}
  ],
  "roles": ["iceberg-data-all-access"],
  "users": [],
  "groups": [],
  "conditions": [{ "type": "action-matches", "values": ["GetObject", "PutObject"] }],
  "delegateAdmin": false
}]' policy.json > policy.updated.json

Apply updated policy definition:

curl   -u [***RANGER_ADMIN_USERNAME***]:[***RANGER_ADMIN_PASSWORD***] \
  --fail -H "Content-Type: application/json" \
  --request PUT \
  -H "accept: application/json" \
  --data @policy.updated.json \
  "[***RANGER_URL***]/service/public/v2/api/service/[***RANGER_SERVICE_NAME***]/policy/[***POLICY_NAME***]"

Example,

curl -u admin:Admin123 \
  --fail -H "Content-Type: application/json" \
  -H "accept: application/json" \
  --request PUT \
  --data @policy.updated.json \
  "https://ranger-host.example.com:6182/service/public/v2/api/service/cm_ozone/policy/S3_VOLUME_POLICY_FOR_OZONE_CANARY"