Built-in access control privileges

The built-in access control system in Starburst Enterprise allows setting individual privileges on various entities.

• Built-in access control overview provides configuration instructions and a terminology overview.

• Built-in access control roles describes the roles-first approach of this system.

• This page lists each entity that can be tracked and the privileges settable on each.

• Differences between built-in access control and Apache Ranger compares the two systems.

Predefined privilege grants

A newly installed cluster’s built-in access control system has the EXECUTE privilege predefined for Queries granted to the public role. This allows any user to execute a query by default. The sysadmin role can remove or change this setting.

Privilege actions

When logged into Starburst Enterprise web UI with sysadmin or its equivalent, the Roles and privileges panel shows a list of configured roles, with a Privileges link for each one. Click that link to open a column on the right with a list of that role’s privilege settings. Up to three actions are available for each privilege, depending on the user’s current role and its grants.

Add privileges

Click the Add privileges button in the Privileges view to be taken to the Add privilege screen. The role that the new privilege applies to appears at the top of the screen.

Each privilege can be configured for only one entity type. Select the entity type to add a privilege for from the row of radio buttons in the resulting screen. For each entity type, you must specify how broadly the action is to apply, which is entity-specific. This is described in the following sections for each entity category.

Each privilege can do one of the following for the role it is configured for:

• Allow - Grant the role the privilege

• Deny - Explicitly deny the role privilege

The Allow role receiving grant to grant to others option allows the privilege to be applied to all current and future users granted this role, as well grant these the ability to remove the privilege.

You can cancel the Add privilege action at any time by clicking the Cancel button. To save a privilege, click the Save privilege button.

Once saved, a privilege cannot be edited.

Remove privilege

The sysadmin role, and roles for which a privilege has been marked with Allow role receiving grant to grant to others may delete a privilege from a role using the delete (trashbin) icon for that privilege. This action is not enabled if the current user and their selected role does not have the grant for that privilege from the Allow role receiving grant to grant to others option.

Copy entity name

Each privilege has a copy icon. Clicking this icon copies the text immediately to its left.

Entity types

The following sections describe the privileges available for each entity.

Table entities

When selecting Tables in the Add privilege screen, you must choose All catalogs or a catalog from the Catalog dropdown, as well as All schemas or a schema from the Schema dropdown. You can also narrow your selection to:

• a table or view in that schema

• a column in that table or view

You can also enter a schema, table, or column name that does not currently exist as a custom entity. This creates a placeholder rule that applies to future queries once an entity with that name is created.

Select one or more of the following privileges to grant them to the role for the specified entity:

Table privileges

Privilege	Grants the right to:
ALTER	Edit the properties of an existing table, view or schema, or to use the ALTER TABLE, ALTER VIEW, or ALTER SCHEMA commands.
CREATE	Create a new table in the current context, or use the CREATE TABLE or CREATE TABLE AS commands.
DELETE	Delete rows from an existing table or run the DELETE command.
DROP	Delete an existing table, view, or schema, or run the DROP TABLE, DROP VIEW, or DROP SCHEMA commands.
INSERT	Insert new rows into a table, or use the INSERT command.
REFRESH	Refresh a materialized view or run the REFRESH MATERIALIZED VIEW command.
SELECT	Browse the query editor’s catalog and schema tree, or use the SELECT command. Can optionally include a column mask or row filter to further control access to specific data in the result set.
SHOW	Browse the query editor’s catalog and schema tree, or use the following SQL commands: SHOW TABLES and SHOW CREATE TABLE.
UPDATE	Update rows in an existing table, or use the UPDATE command.

Column masks and filters

You can control what data a user may see by applying column masks and row filters to a privilege. This option is only available on privileges that allow access to the SELECT action for one or more columns.

Column masks hide information from users by masking the values of columns as configured. Row filters exclude rows from a query’s result set when a custom expression matches the contents of the row. Masks and filters can be applied to tables, views, and materialized views.

For more information, read Built-in access control masks and filters.

Role entities

When selecting Roles in the Add privilege screen, you can select All roles to apply the current change to all roles, or select a role name from the list. You cannot enter the name of an undefined role.

Use the checkboxes to grant the role one or more of the following privileges for the selected entity. The SHOW privilege allows the target role to run SHOW CURRENT ROLES.

Role privileges

Privilege	Grants the right to:
CREATE	Create a new role, or run the CREATE ROLE command.
DROP	Delete an existing role, or run the DROP ROLE or REVOKE ROLES commands.
SHOW	Run the SHOW [CURRENT] ROLES, or SHOW ROLE GRANTS commands.

Note

Selecting All roles does not include the sysadmin role.

User entities

When selecting Users in the Add privilege screen, you can select All users (recommended) or an individual name you select from the list. SEP does not reach into the cluster’s authentication system to list or validate all available usernames. You can enter a username that does not appear, but you must use the exact case and spelling of the name as recorded in the cluster’s authentication system.

There is one privilege to grant for the user entities:

User privileges

Privilege	Grants the right to:
IMPERSONATE	Control whether the specified user can participate in User impersonation.

Warning

While this privilege focuses on users, the privilege itself is role-based. If specific users are selected in this privilege and they are not granted the role to which this privilege applies, the user does not have the privilege. When not using the All users option, you must ensure that the selected users have been granted the role.

Query entities

When selecting Queries in the Add privilege screen, there are three privileges to grant:

Query privileges

Privilege	Grants the right to:
EXECUTE	Run a query in the current context.
SHOW	See a list of all queries running in the cluster, and see the details of a particular query.
KILL	Enables the Kill query button to appear in the Query details panel for a long-running query; it does not affect the Cancel button in the Query editor, which is always available. Using the Kill query button stops a long-running query with the Cancel button in the query editor, or with the Kill query button in the Query details pane for that query.

Data product entities

This entity type only appears as an option when starburst.data-product.enabled is set to true.

The Add privileges screen lets you specify how narrowly the privilege applies:

• Select * on the domain field to manage all domains and all data products in those domains.

• Select a specific domain and * for data products to manage that domain and all data products in the domain.

• Select a specific domain and specific data product to manage that data product.

Use the checkboxes to grant one or more of the following privileges to the specified domain or data product:

Data product privileges

Privilege	Grants the right to:
ALTER	Edit existing domain or data product.
CREATE	Create new data products within a domain.
DROP	Delete an existing domain or data product.
PUBLISH	Publish a created data product into the data source.
SHOW	Make a created data product visible to a set of users.

User interface entities

The Starburst Enterprise web UI components that a user sees when assuming a given role depends on which user interface entities the role has been granted SHOW privileges for. This entity type allows you to grant or deny the ability for users in the role to access the various Starburst Enterprise web UI components.

Note

The role currently applied to your user affects the options you can see in the Features drop-down when setting SHOW privileges for user interface entities.

Use the SHOW checkbox to grant the role access to one or more of the following tabs in the Starburst Enterprise web UI:

User interface entities

Privilege	Grants the right to view:
All available SEP features	Includes all individual UI screens listed in this table.
Query editor tab	The SEP query editor.
Data products tab	The data products screen and all associated tabs.
Cluster overview tab	The overview screen.
Query overview tab	The query overview report and its filters.
Cluster history tab	The cluster history charts and their filters.
Usage metrics tab	The usage metrics report and its filter.
All available settings	Includes the license information and customized login settings screens listed in this table.
License information settings tab	The license information report showing all possible SEP features and their statuses based on your current license file.
Customize login settings tab	The setting screen that allows you to customize the SEP login by uploading a logo, creating a banner message, or both.

Access logs for UI elements are disabled by default. To enable the access logs, set the starburst.access-control.audit.access-log.exclude-events configuration property to ui-view=none.

Grant access to object storage locations

Roles with administrative rights can grant and block role access to specified object storage locations by selecting Add privileges > Location in the Starburst Enterprise web UI.

Location access controls are disabled by default. To enable location access controls, set the following configuration property to true:

starburst.access-control.location.enabled=true

When location access controls are first enabled, only the sysadmin role has access to any locations. Location permissions must be granted through the Starburst Enterprise web UI.

Location URI must start with the location protocol and end with an asterisk /*, for example:

s3://my-bucket/path1/path2/*

Granting access to this location for a specific role allows that role to access s3://my-bucket/path1/path2/ and all of its sub-folders. Up to 10 location privileges can be added at a time.

Warning

Roles with assigned location access can not be deleted until location access is removed.

Location grants are recorded in the built-in access control audit log.

Function entities

Selecting Other, then Functions allows you to control access to:

• custom functions

• table functions

• window functions

• aggregation functions

• scalar functions

To control access to a specific function, type its name in the menu and select it. You can select one or more specific functions from the menu, one at a time, or you can check the All functions box to select all functions.

Note

You can create privileges for functions that do not yet exist, but you must ensure that you name them exactly as specified in the privilege.

The right to run any built-in functions other than those listed here is always allowed.

There is one privilege to grant:

Custom function privileges

Privilege	Grants the right to:
EXECUTE	Run one or all custom functions.

Table functions

When “Functions” is selected, you must indicate whether the functions you wish to configure access for are table functions using the Yes and No radio buttons. When Yes is selected, menus are enabled to select catalogs and schemas.

Select a specific catalog Catalog menu. Once a catalog is selected, the Schema menu is enabled. Select a specific schema from the Schema menu. Once the schema is selected, type the exact name of a specific table function in the Function box; you can specify more than one table function, but you must do so one entry at a time. When all table functions have been specified, set the desired privilege and Deny or Allow as usual. Ensure that the Execute action is checked, and click Save privilege to save.

Note

You can create privileges for table functions that do not yet exist, but you must ensure that you name them exactly as specified in the privilege.

Procedure entities

Selecting Other, then Procedures lets you manage which roles can run catalog-defined procedures. Note that these are not the same as stored procedures provided by some data sources such as PostgreSQL.

The Add privilege screen lets you specify all catalogs with the All catalogs checkbox, or narrow the target to an individual catalog, then optionally to an individual schema or All schemas. Once you select the target of the privilege, enter the name of a procedure, or select the All procedures box to specify all procedures for the selected catalogs and schemas.

There is one privilege to grant:

Procedure privileges

Privilege	Notes
EXECUTE	For catalogs that have defined procedures, grants the right to use the command CALL to run one or all procedures in a catalog, or to run the procedures restricted to a schema, or to run an individual procedure.

System session property entities

Selecting Other, then System session properties in the Add privilege screen lets you choose one or more system session properties from the multi-select dropdown, or check the All system session properties box to specify all session properties to grant the privilege on.

There is one privilege to grant:

System session property privileges

Privilege	Grants the right to:
SET	Allow all or one specified session property to be set.

Catalog session property entities

Selecting Other, then Catalog session properties lets you specify a single catalog on which to grant session property privileges, or All catalogs. If the catalog’s data source enumerates catalog session properties, you can select an individual session property name from the third drop-down list. Alternatively, you can check the All catalog session properties box.

There is one privilege to grant:

Catalog session property privileges

Privilege	Grants the right to:
SET	Allow all or one specified catalog session property to be set. Applies to catalogs that have a defined set of session properties.

Schema property entities

Roles with administrative rights can grant and block access to schema properties by selecting Add privileges > Other > Schema properties.

There is one privilege to grant:

Schema property privileges

Privilege	Grants the right to:
SET	Allow one, multiple, or all schema properties to be set.

Tables property entities

Roles with administrative rights can grant and block access to table properties by selecting Add privileges > Other > Table properties.

Table property privileges

Privilege	Grants the right to:
SET	Allow one, multiple, or all table properties to be set.