Is it possible to reference more than one Atlas tag in one Ranger policy via the Policy Conditions? Yes. Following can be used to access details of all tags associated with the resource being accessed: ctx.getAllTagTypes() <== returns names of all tags associated with the resource (Set<String>)
ctx.getTagAttributes(tagType) <== returns attributes of given tag (Map<String, String>)
ctx.getAttributeValue(tagType, attrName) <== returns value of attribute 'attrName' in tagType tag The usecase you describe seems to require access-control based on tenancy and the zone in which the data resides. Please consider the following approach: 1. Define a classification named 'DATA_ZONE', with one attribute named "name" - as shown below: "classificationDefs": [
{
"name": "DATA_ZONE",
"attributeDefs": [
{
"name": "name",
"typeName": "string"
}
]
}
] 2. Define one classification for each tenant. In your example, you already have 2 classifications "tenancy_xxx" and "tenancy_yyy". 3. Create one tag-based policy for each tenant. Per your example, you would create 2 policies - one for "tenancy_xxx" tag and another for "tenancy_yyy" tag. 4. In policy for each tenant, you can use conditions as shown below to allow/deny access to users/groups: ctx.getAttributeValue("DATA_ZONE", "name").equals("landing") ctx.getAttributeValue("DATA_ZONE", "name").equals("staging") ctx.getAttributeValue("DATA_ZONE", "name").equals("data_lake")
... View more
