HAWQ Resources and Permissions

The HAWQ Ranger policy editor always displays the complete list of HAWQ permissions. This list is not filtered by the operations that are actually supported by the resource(s) you have selected.

The following table identifies the specific permissions supported by each HAWQ resource.

Policies for Database Operations

The database operations governed by HAWQ-Ranger authorization are those that you perform at the purely database-level. These operations include connecting to the database, creating schemas, and creating temporary tables and sequences. Use the following HAWQ Ranger Policy Details to assign permissions for these operations:

specifying the permissions you wish to assign:

Policies for Schema Operations

You perform many HAWQ operations within the scope of a specific database and schema, including creating/dropping/altering database objects. These operations will require permission to use the specified schema.

The HAWQ schema named public is the default schema. When HAWQ-Native authorization is in effect, users are automatically granted access to this schema. When Ranger is enabled, users must be explicitly assigned the usage-schema permission to the public schema.

Use these HAWQ Ranger Policy Details to assign permission for schema-related operations:

specifying these permissions:

Policies for Table Operations

You can insert data into and select a table within schemas in which you have usage-schema permissions. Use the following HAWQ Ranger Policy Details to assign permission for these operations:

specifying the permissions you wish to assign:

Policies for Sequence Operations

You can use and select sequences and update sequence values in schemas in which you have usage-schema permissions. You can also use the nextval() and setval() HAWQ built-in functions to return and set sequence values. Use the following HAWQ Ranger Policy Details to assign permission for these operations:

specifying the permissions you wish to assign:

Policies for Function Operations

You can execute user-defined functions in schemas in which you have usage-schema permissions. Use the following HAWQ Ranger Policy Details to assign permission for this operation:

specifying the permissions you wish to assign:

Note: Functions typically access database objects such as tables, views, sequences, etc and other functions. When setting up your HAWQ policies, ensure you have also provided access to all database resources referenced within the function (recursively).

Policies for Language Operations

Only super-users may register and drop languages for a specific database. These operations are governed by HAWQ-Native authorization.

You may choose to permit users to use a specific language to create user-defined functions. Use these HAWQ Ranger Policy Details to assign such permission:

specifying these permissions:

Policies for Tablespace Operations

Only super-users may create and drop tablespaces. These operations are governed by HAWQ-Native authorization.

You may choose to allow specific users to create tables within an existing tablespace. Use these HAWQ Ranger Policy Details to assign such permissions:

specifying these permissions:

Policies for Protocol Operations

You may choose to permit access to the pxf, gpfdist, and/or http protocols to create readable and writable external tables. Use the following HAWQ Ranger Policy Details to assign permission for these operations:

specifying the permissions you wish to assign: