Skip to main content
Granting a role access to a storage location gives the role an access level to a path in an object storage bucket. For example, you can give the nx1_ingest role the Read level on a folder, so it can read the files that you ingest from it.

Prerequisites

Before starting this task, ensure you have the following: Required roles: nx1_migration_admin or nx1_migration_ops.

Grant a role access to a storage location

Perform these steps to grant a role access to a storage location.
  1. Log in to NexusOne.
  2. On the top navigation bar, hover your mouse over Govern and then select Data Access.
  3. Click the Grant access tab.
  4. Under Who, in the Groups field, select the role to give access to. Roles appear as groups.
  5. Optional: In the Users field, select the users to give access to.
  6. Under On what, click Storage location.
  7. Select the location:
    • Bucket: Select a bucket to fill in the Location field with the bucket’s path. This field appears only when NexusOne lists your buckets.
    • Location: Enter the path, such as s3a://bucket/path/. If you selected a bucket, then add the folder after it. If you didn’t, then enter the full path.
    • This folder and everything in it: Turn it on to include every file below the path.
  8. Under Access level, select Read or Write. Storage locations offer only these two levels. For what each level includes, refer to Access levels.
  9. Optional: In the Why field, enter who asked for the access and what it is for.
  10. Click Preview to see the policies the grant writes and whose access changes.
  11. Click Apply.

Additional resources

  • For an overview of the Govern feature, refer to Govern Overview.
  • You can also grant this access directly in Ranger. For the steps, refer to Create a policy.