Skip to content

Manage Resources List

Runtime tab

The Runtime tab describes the Omni Connector on a Runtime Plane, which is a separate connector from PolicySync. Sections without a Runtime tab apply to PolicySync only.

You can configure the Databricks SQL connector to manage access control policies for specific databases, tables/views. You can specify lists to include and exclude resources. The connector manages access control policies for resources in the include list and ignores resources in the exclude list. If a resource is in the exclude list, the connector does not manage it, even if it is also in the include list.

Use the following properties to specify comma-separated list of databases and tables/views for which access control should be managed by PolicySync. To manage all resources, leave these properties unspecified. You can also use wildcard characters (*) to match multiple databases, tables, or views.

Example:

  • Databases: test_db1,test_db2*.sales*
  • Tables/Views: test_db1.table1,test_db2*.table2,sales*.view*

Setup

Warning

  • Values are case-sensitive.
  • Provide fully qualified names for databases, tables/views. E.g. test_db1.table1
  • Replace the example values with your actual resource names.

  1. SSH to the instance where Privacera Manager is installed.

  2. Run the following command to open the .yml file to be edited.

    If you have multiple connectors, then replace instance1 with the appropriate connector instance name.

    Bash
    1
    vi ~/privacera/privacera-manager/config/custom-vars/connectors/databricks-sql-analytics/instance1/vars.connector.databricks.sql.analytics.yml

  3. Set the following properties to enable the connector to manage the permissions for databases, tables/views, and other resources in the Databricks SQL:

    YAML
    1
2
    CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_DATABASE_LIST: "test_db1"
CONNECTOR_DATABRICKS_SQL_ANALYTICS_MANAGE_TABLE_LIST: "test_db1.table1"

  4. For excluding resources, set the following properties:

    YAML
    1
2
    CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_DATABASE_LIST: "test_db1"
CONNECTOR_DATABRICKS_SQL_ANALYTICS_IGNORE_TABLE_LIST: "test_db1.table1"

  5. Once the properties are configured, run the following commands to update your Privacera Manager platform instance:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. In PrivaceraCloud portal, navigate to Settings -> Applications.

  2. On the Connected Applications screen, select Databricks SQL.

  3. Click on the icon or the Account Name to modify the settings.

  4. On the Edit Application screen, go to Access Management.

  5. For including resources, enter the following values in the respective fields:

    • Databases to set access control policies: test_db1
    • Tables to set access control policies: test_db1.table1

  6. For excluding resources, enter the following values in the respective fields:

    • Databases to ignore while setting access control policies: test_db1
    • Tables to ignore while setting access control policies: test_db1.table1

  7. Click SAVE to apply the changes.

  1. In the portal, navigate to Settings → Runtime Plane and open your Runtime Plane.

  2. Open the Connectors tab and open your Databricks SQL (Hive Metastore) connector.

  3. Go to ACCESS CONTROL CONFIGS and expand Managed Resources.

  4. Under Include, enter one name or wildcard pattern per line. Names are database.table:

    Text Only
    1
2
3
    test_db1
test_db2*.sales*
test_db3.table1

  5. Under Exclude, enter the resources to ignore, one per line. Exclude takes precedence over Include:

    Text Only
    1
    test_db1.tmp_*

  6. Under Resource types governed, leave it empty to use the defaults: DATABASE, TABLE, VIEW and UDF. To narrow it, list only the types you want.

  7. Select Save.

Note

  • * and ? match within one segment. A shorter pattern covers everything below it, so test_db1 covers every table, view and function in that database.
  • A new connector governs nothing until you add an Include entry. Include is empty by default, which means deny-all. Enter * alone to govern everything.
  • Narrowing the scope does not delete anything or revoke grants. Resources that fall out of scope are kept and marked as ungoverned.

For more details, see Managed resources.