I have a HDP kerberized cluster with Ranger enabled, where the data is encrypted by KMS with multiple encryption zones.
Users can only access data via Hive interface.
In order to access all the data I can choose on of the options:
1. Give hive user an access to specific HDFS folders along with the permission to decrypt the data. However if hive user gets compromised, it will have an access to all the data.
2. Enable doAs option in Hive, and access HDFS as end user. This however will require policies for user on both: hdfs and hive and if user has an access to hdfs (for some reason) the hive permissions on column level becomes useless.
What's the valid approach here?