Cloudera Docs

Creating a resource policy for a volume using UI

Learn how to create a resource policy in Ranger to grant the permissions for a volume using UI.

  1. Sign in to Cloudera Manager.
  2. In the left navigation, click Clusters.
  3. Select the relevant Ranger cluster.
  4. Click the Web UI dropdown menu and click one of the Ranger Admin Web UI. The Ranger log in page displays.
  5. Sign in to Ranger. The Ranger home page displays.
  6. In the left navigation pane, select Resource Policies, and then select cm_ozone.
  7. Use one of the following methods to locate the policy associated with your target volume:
    • If a volume policy already exists (for example, S3_VOLUME_POLICY_FOR_OZONE_CANARY), enter the policy name in the search box and click the link in the Policy ID column to edit it.
    • If no policy exists for the volume,
      1. Click Add New Policy.
      2. Enter a Policy Name.
      3. In the Resources section, click the Ozone Volume drop-down menu and select Ozone Volume.
      4. In the Add policy Resources text box, enter the volume name (for example, s3v).
      5. Wait for few seconds and then select create [***VOLUME_NAME***] (for example, create s3v).
  8. In the Allow Rules section, perform the following actions:
    1. (Optional) Click the plus (+) button to add a new row.
    2. Under Select Roles, click the Select Roles dropdown menu.
    3. Select your target access role (for example, iceberg-data-all-access).
    4. Under Permissions, click the plus sign (+).
    5. Select the check boxes next to Read and List (optional), and then select the check mark at the bottom of the dialog box.
    6. Locate the row assigned to your target user or role (for example, iceberg-data-all-access).
    7. Under Rule Conditions, click the plus (+) button to add a new condition.
    8. Under Actions, select GetObject and PutObject.
    9. Click Save in the dialog box.
  9. Click Save.