Skip to main content
Create a Ranger policy yourself when you want full control over its resources, principals, and settings. NexusOne writes the policy directly to Ranger when you submit it.

Prerequisites

Before starting this task, ensure you have the following: Required roles: nx1_migration_admin or nx1_migration_ops.

Create a policy

Perform these steps to create a policy.
  1. Log in to NexusOne.
  2. On the top navigation bar, hover your mouse over Govern and then select Data Access.
  3. Click the All policies tab.
  4. Click New Policy.
  5. Describe the policy:
    • Policy name: Optional. Enter a name. If you leave it empty, NexusOne names the policy from its resources.
    • Policy type: Select Access, Masking, or Row Filter.
    • Description: Optional. Enter who or what the policy governs, and why.
  6. In the Resources section, add each resource the policy covers:
    1. Select a resource in the Resource list.
    2. Enter one or more values, separated by commas.
    3. Optional: Select Excludes to apply the policy to everything except those values, or Recursive to include everything under them. A resource shows these options only when Ranger supports them.
    4. Click Add.
    A resource needs all of its parents. For example, a table needs its catalog and schema.
  7. Set who the policy applies to. The section depends on the policy type:
    • Access: In the Allow section, do the following:
      1. In the Access types field, select the access types.
      2. In the Groups and Users fields, select who gets the access.
      3. Optional: Select Delegate admin to let them grant the access to others.
      4. Optional: Click Add allow item to add another row.
      5. Optional: To deny access or add exceptions, expand Deny items, Allow exceptions, or Deny exceptions.
    • Masking: In the Masking section, select the Mask type, and then select the access types, groups, and users. For a Custom mask type, enter the Custom mask expression. Optionally, enter a Mask condition so the mask applies only when the condition is true. Click Add mask rule to add another rule.
    • Row Filter: In the Row filters section, enter a Filter expression, and then select the access types, groups, and users. The expression is a SQL WHERE fragment, for example region = 'EU'. Click Add filter rule to add another rule.
  8. Optional: In the Options section, set the following:
    • Enabled: When off, Ranger ignores the policy.
    • Audit logging: Writes an audit record every time Ranger evaluates the policy.
    • Deny all else: Denies anything the policy doesn’t explicitly allow.
    • Priority: Select Normal or Override.
    • Labels: Enter a label and press Enter to add it.
  9. Click Create policy.

Additional resources

For an overview of the Govern feature, refer to Govern Overview.