How to deny admin user/group from dropping hive tables from Hue?

[#1]

Hi community,

From Hue security browser, I have a RBAC role (admin), which was given all permission on all databases.
I have this Database A which consists of table1,2,3
I want to deny this admin role from dropping Database A -> Table1 and Table2.

Can you show me how this can be done on sentry?

Thanks!!

[#2 · Accepted solution]

Hi @Shivakuk 

Please refer below doc, you can use the Revoke statements in sentry to restrict the access on a database

https://docs.cloudera.com/documentation/enterprise/6/latest/topics/sg_hive_sql.html#revoke_privilege...

Let us know if this helps

[#3 · Accepted solution]

Hi @Shivakuk 

Please refer below doc, you can use the Revoke statements in sentry to restrict the access on a database

https://docs.cloudera.com/documentation/enterprise/6/latest/topics/sg_hive_sql.html#revoke_privilege...

Let us know if this helps

[#4]

The document from Cloudera does not specifically mention on how to revoke drop privilege.

Please advise.

[#5 · Accepted solution]

Hi  @Shivakuk  As I test Sentry does not support DROP and DELETE privilege.

However if you want to remove the DROP access from Admin user, then you have first remove ALL privileges and just provide  SELECT and INSERT privileges to the user

NOTE: The DELETE, UPDATE, and UPSERT operations require the ALL privilege on the DB/ Table/ Column.