Cloudera Docs

Ozone scan fails with "PERMISSION_DENIED" on volume or bucket access

Ozone scans return PERMISSION_DENIED on Apache Ranger-managed clusters when the CMA Agent principal lacks read and list access; add the agent user to the global Ranger Ozone policy.

Symptom

Ozone scan fails with:

OzoneScanException: Error occurred while scanning volume s3v
- Exception message: PERMISSION_DENIED

The CMA Agent log shows an ACL check failure for the cma-agent user (or the configured Kerberos principal) when listing buckets or reading volume metadata.

Cause

On clusters where Apache Ranger manages Ozone authorization, native Ozone ACLs (set through ozone sh volume addacl) are ineffective. Ranger intercepts all access checks before native ACLs are evaluated, so granting access through ozone sh has no effect.

The Cloudera Migration Assistant Ozone scanner requires read and list permissions on volumes, buckets, and keys to inventory the cluster's Ozone storage.

Remedy

  1. Open the Ranger Admin UI (typically https://<ranger-host>:6182).
  2. Click the Ozone service (for example, cm_ozone).
  3. Find the policy named all - volume, bucket, key and click Edit.
  4. In the Allow Conditions section, add a new entry:

    • Select User: cma-agent (or the Kerberos principal used by the CMA Agent)

    • Permissions: read, list

  5. Click Save.

    The policy change takes effect within 30 seconds (Ranger's default policy refresh interval for plugins). No service restart is required.

  6. Retry the Ozone scan.
  7. Verify the Ranger Ozone policies: 
    curl -sk --negotiate -u : "https://<ranger-host>:6182/service/plugins/policies/service/name/cm_ozone" | \
  python3 -c "import sys,json; [print(f'  {p[\"name\"]}') for p in json.load(sys.stdin).get('policies',[])]"