Skip to main content
Granting a role access to data gives the role an access level on a catalog, schema, table, or columns. For example, you can give the nx1_engineer role the Read level on a table, so engineers can query it.
Data means the catalogs, schemas, tables, and columns in the NexusOne catalog. To give access to files in an object storage bucket, refer to Grant a role access to a storage location.

Prerequisites

Before starting this task, ensure you have the following: Required roles: nx1_migration_admin or nx1_migration_ops.

Grant a role access to data

Perform these steps to grant a role access to data.
  1. Log in to NexusOne.
  2. On the top navigation bar, hover your mouse over Govern and then select Data Access.
  3. Click the Grant access tab.
  4. Under Who, in the Groups field, select the role to give access to. Roles appear as groups.
  5. Optional: In the Users field, select the users to give access to.
  6. Under On what, click Data.
  7. Select the data:
    • Catalog: Select the catalog.
    • Schema: Select the schema. If you leave it empty, then the access covers every schema in the catalog.
    • Table: Select the table. If you leave it empty, then the access covers every table in the schema.
    • Columns: Select the columns. This field appears after you select a table. If you leave it empty, then the access covers every column.
  8. Under Access level, select the level to grant. For what each level includes, refer to Access levels.
  9. Optional: After you select a table, under Conditions, limit the access:
    • Click Hide a column. In the new row, select the column in the first dropdown. The second dropdown offers the following ways to hide the column’s values:
      • Custom: Applies a custom masking expression from Ranger.
      • Hash: Replaces the value with its hash.
      • Nullify: Replaces the value with null.
      • Partial mask: show first 4: Hides all but the first four characters.
      • Partial mask: show last 4: Hides all but the last four characters.
      • Redact: Replaces the value with a placeholder character.
      • Unmasked: Keeps the original value.
      To hide more columns, click Hide a column again.
    • In the Only rows where field, enter a SQL condition, such as region = 'EU', to limit the rows.
  10. Optional: In the Why field, enter who asked for the access and what it is for.
  11. Click Preview to see the policies the grant writes and whose access changes.
  12. Click Apply.

Additional resources

  • For an overview of the Govern feature, refer to Govern Overview.
  • You can also grant this access directly in Ranger. For the steps, refer to Create a policy.