Cloudera Docs

Using resource-based authorization policies for Trino

The Apache Ranger access policy model consists of two major components: the specification of the resources a policy is applied to, such as Catalog, Schema, tables, columns, and so on; and the specification of access conditions for specific users and groups.

The following table lists the allowed permissions and the actions that they support in Trino:
Permission Action
Select Provides read access to an object (table, view, and materialized view)
Insert Provides the ability to insert records into a table
Update Provides the permission to modify column values in existing rows of a table
Delete Provides the ability to remove records from a table
Create Provides the permission to create an object (schema, table, view, and materialized view)
Alter Provides the ability to:
  • Rename a schema
  • Rename a table or column
  • Add or drop a column
  • Set session property
Drop Provides the permission to drop an object (schema, table, view, and materialized view)
Use Update the session to use the specified catalog and schema
Grant Assign privileges to users on an object
Revoke Deny privileges to users on an object
Show Provides the ability to:
  • List the existing objects (catalogs, schemas, tables and views)
  • Show the SQL statement that creates a schema, table, or view
Excute Provides the permission to run a SQL statement

Perform the following steps to set up the required authorization policies for Trino:

  1. In Cloudera Manager, click Clusters > Ranger > Ranger Admin Web UI, enter your username and password, and then click Sign In.
    The Ranger Service Manager page for Cloudera services is displayed.
  2. Click the cm_trino resource-based service to create or modify a Trino policy.
    Image of Ranger Trino service
  3. In the Trino Policies page, under the Access tab, click Add New Policy to create a new Trino policy.
    The Create Policy modal displays controls for creating details for a new policy.
    Ranger Trino Service Create Policy page
  4. Enter a name for the policy and choose the Trino catalog, schema, tables, and columns that you want to give access to.
  5. In the Allow Conditions pane, add the "trino" user, and then click to choose the necessary permissions.
    Ranger Trino allow conditions while creating a policy
  6. Click Save to save the policy.