Cloudera Docs

Editing a policy to access Iceberg files

You learn how to edit the existing default Hadoop SQL Storage Handler policy to access files on the object store. This policy is one of the two Ranger policies required to use Iceberg.

The Hadoop SQL Storage Handler policy allows references to Iceberg table storage location, which is required for creating or altering a table. You use a storage handler when you create a file stored as Iceberg on the file system or object store.

In this task, you specify Iceberg as the storage-type and allow the broadest access by setting the URL to *.

The Hadoop SQL Storage Handler policy supports only the RW Storage permission. A user having the required RW Storage permission on a resource, such as Iceberg, that you specify in the storage-type properties, is allowed only to reference the table location (for create/alter operations) in Iceberg. The RW Storage permission does not provide access to any table data. You need to create the Hadoop SQL policy described in the next topic in addition to this Hadoop SQL Storage Handler policy to access data in tables.

For more information about these policy settings, see Ranger Storage Handler documentation.

  1. Log into Ranger Admin Web UI.
    The Ranger Service Manager appears:
  2. In Policy Name, enable the all - storage-type, storage-url policy.
  3. In Service Manager, in Hadoop SQL, select Edit and edit the all storage-type, storage-url policy.
  4. Below Policy Label, select storage-type, and enter iceberg.
  5. In Storage URL, enter the value *, enable Include.
    For more information about these policy settings, see Ranger storage handler documentation.
  6. In Allow Conditions, specify roles, users, or groups to whom you want to grant RW storage permissions.
    You can specify PUBLIC to grant access to Iceberg tables permissions to all users. Alternatively, you can grant access to one user. For example, add the systest user to the list of users who can access Iceberg:
    For more information about granting permissions, see Configure a resource-based policy: Hadoop-SQL.
  7. Add the RW Storage permission to the policy.
  8. Save your changes.