I've seen it recommended to change the first line to: if [ "$SERVICE" = "cli" ] && [ "$USER" != "ambari-qa" ]; then Without this, Ambari won't be able to check Hive metastore state and will throw an alert (at least in HDP 2.4). ... View more

You can use Apache Ranger to set permissions levels for tables. With the 2.5 release (currently tech preview) you can use Atlas to tag tables or columns as classified and use Ranger to set or view permissions for anything with the classified tag. ... View more