- Platform Release 6.5
- Privacera Platform Installation
- About Privacera Manager (PM)
- Install overview
- Prerequisites
- Installation
- Default services configuration
- Component services configurations
- Access Management
- Data Server
- PolicySync
- Snowflake
- Redshift
- Redshift Spectrum
- PostgreSQL
- Microsoft SQL Server
- Databricks SQL
- RocksDB
- Google BigQuery
- Power BI
- UserSync
- Privacera Plugin
- Databricks
- Spark standalone
- Spark on EKS
- Trino Open Source
- Dremio
- AWS EMR
- AWS EMR with Native Apache Ranger
- GCP Dataproc
- Starburst Enterprise
- Privacera services (Data Assets)
- Audit Fluentd
- Grafana
- Access Request Manager (ARM)
- Ranger Tagsync
- Discovery
- Encryption & Masking
- Privacera Encryption Gateway (PEG) and Cryptography with Ranger KMS
- AWS S3 bucket encryption
- Ranger KMS
- AuthZ / AuthN
- Security
- Access Management
- Reference - Custom Properties
- Validation
- Additional Privacera Manager configurations
- CLI actions
- Debugging and logging
- Advanced service configuration
- Increase Privacera portal timeout for large requests
- Order of precedence in PolicySync filter
- Configure system properties
- PolicySync
- Databricks
- Table properties
- Upgrade Privacera Manager
- Troubleshooting
- Possible Errors and Solutions in Privacera Manager
-
- Unable to Connect to Docker
- Terminate Installation
- 6.5 Platform Installation fails with invalid apiVersion
- Ansible Kubernetes Module does not load
- Unable to connect to Kubernetes Cluster
- Common Errors/Warnings in YAML Config Files
- Delete old unused Privacera Docker images
- Unable to debug error for an Ansible task
- Unable to upgrade from 4.x to 5.x or 6.x due to Zookeeper snapshot issue
- Storage issue in Privacera UserSync & PolicySync
- Permission Denied Errors in PM Docker Installation
- Unable to initialize the Discovery Kubernetes pod
- Portal service
- Grafana service
- Audit server
- Audit Fluentd
- Privacera Plugin
-
- Possible Errors and Solutions in Privacera Manager
- How-to
- Appendix
- AWS topics
- AWS CLI
- AWS IAM
- Configure S3 for real-time scanning
- Install Docker and Docker compose (AWS-Linux-RHEL)
- AWS S3 MinIO quick setup
- Cross account IAM role for Databricks
- Integrate Privacera services in separate VPC
- Securely access S3 buckets ssing IAM roles
- Multiple AWS account support in Dataserver using Databricks
- Multiple AWS S3 IAM role support in Dataserver
- Azure topics
- GCP topics
- Kubernetes
- Microsoft SQL topics
- Snowflake configuration for PolicySync
- Create Azure resources
- Databricks
- Spark Plug-in
- Azure key vault
- Add custom properties
- Migrate Ranger KMS master key
- IAM policy for AWS controller
- Customize topic and table names
- Configure SSL for Privacera
- Configure Real-time scan across projects in GCP
- Upload custom SSL certificates
- Deployment size
- Service-level system properties
- PrestoSQL standalone installation
- AWS topics
- Privacera Platform User Guide
- Introduction to Privacera Platform
- Settings
- Data inventory
- Token generator
- System configuration
- Diagnostics
- Notifications
- How-to
- Privacera Discovery User Guide
- What is Discovery?
- Discovery Dashboard
- Scan Techniques
- Processing order of scan techniques
- Add and scan resources in a data source
- Start or cancel a scan
- Tags
- Dictionaries
- Patterns
- Scan status
- Data zone movement
- Models
- Disallowed Tags Policy
- Rules
- Types of rules
- Example rules and classifications
- Create a structured rule
- Create an unstructured rule
- Create a rule mapping
- Export rules and mappings
- Import rules and mappings
- Post-processing in real-time and offline scans
- Enable post-processing
- Example of post-processing rules on tags
- List of structured rules
- Supported scan file formats
- Data Source Scanning
- Data Inventory
- TagSync using Apache Ranger
- Compliance Workflow
- Data zones and workflow policies
- Workflow Policies
- Alerts Dashboard
- Data Zone Dashboard
- Data zone movement
- Example Workflow Usage
- Discovery health check
- Reports
- Built-in Reports
- Saved reports
- Offline reports
- Reports with the query builder
- How-to
- Privacera Encryption Guide
- Essential Privacera Encryption terminology
- Install Privacera Encryption
- Encryption Key Management
- Schemes
- Scheme Policies
- Encryption Schemes
- Presentation Schemes
- Masking schemes
- Encryption formats, algorithms, and scopes
- Deprecated encryption formats, algorithms, and scopes
- Encryption with PEG REST API
- PEG REST API on Privacera Platform
- PEG API Endpoint
- Encryption Endpoint Summary for Privacera Platform
- Authentication Methods on Privacera Platform
- Anatomy of the /protect API Endpoint on Privacera Platform
- About Constructing the datalist for protect
- About Deconstructing the datalist for unprotect
- Example of Data Transformation with /unprotect and Presentation Scheme
- Example PEG API endpoints
- /unprotect with masking scheme
- REST API Response Partial Success on Bulk Operations
- Audit Details for PEG REST API Accesses
- REST API Reference
- Make calls on behalf of another user
- Troubleshoot REST API Issues on Privacera Platform
- PEG REST API on Privacera Platform
- Encryption with Databricks, Hive, Streamsets, Trino
- Databricks UDFs for encryption and masking
- Hive UDFs
- Streamsets
- Trino UDFs
- Privacera Access Management User Guide
- Privacera Access Management
- How Polices are evaluated
- Resource policies
- Policies overview
- Creating Resource Based Policies
- Configure Policy with Attribute-Based Access Control
- Configuring Policy with Conditional Masking
- Tag Policies
- Entitlement
- Request Access
- Approve access requests
- Service Explorer
- User/Groups/Roles
- Permissions
- Reports
- Audit
- Security Zone
- Access Control using APIs
- AWS User Guide
- Overview of Privacera on AWS
- Set policies for AWS services
- Using Athena with data access server
- Using DynamoDB with data access server
- Databricks access manager policy
- Accessing Kinesis with data access server
- Accessing Firehose with Data Access Server
- EMR user guide
- AWS S3 bucket encryption
- S3 browser
- Getting started with Minio
- Plugins
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- Privacera documentation changelog
Access Control using APIs
Concepts in access management
For conceptual background, see How Access Management Works.
GCP
Google Cloud Storage (GCS) allows you to manage your buckets and the files/folders stored in them. Using Google APIs, you can provide access control on GCS service. Then you can create an access policy for the GCS service to allow/deny permissions to read, write, or delete files, folders or buckets.
Prerequisite
Ensure the following prerequisite is met:
GCP DataServer should be up and running. For more information, see Data Server.
Authentication
Generate the access and secret token.
In Privacera Portal, go to Launch Pad > Privacera Token on the left navigation, and click Generate Token. Its corresponding dialog box is displayed.
In the dialog box, add the required details and click Generate Token. The dialog box displays the access and secret key. Now, you can copy the keys.
SSH to the instance where Privacera GCP DataServer is installed or open a terminal on your local machine.
Get the following details for the API. It will be used to access GCS using curl API.
<DATASERVER_URL>
- URL of the GCP DataServer. Based on your DataServer SSL configuration, your URL protocol and port will change. If SSL is enabled, then the default port is 8282, whereas for non-SSL, the default port is 8181.<GCP_PROJECT_NAME>
- Enter the GCP project ID where the GCS application has been added.<ACCESS_TOKEN>
- Copy the access token from step 1.<SECRET_TOKEN>
- Copy the secret token from step 1.Run the following to authenticate.
exportPRIVACERA_TOKEN="<ACCESS_TOKEN>|<SECRET_TOKEN>"exportGCP_PROJECT_NAME="<GCP_PROJECT_NAME>"exportDATASERVER_URL="<DATASERVER_URL>" curl -k -o /tmp/cacerts "${DATASERVER_URL}/services/certificate" chmod 400 /tmp/cacerts
Read file
SSH to the instance where Privacera GCP DataServer is installed or open a terminal on your local machine.
Get the following details for the API:
<BUCKET_NAME>
- Enter the bucket name where the file is stored.<OBJECT_PATH>
- Enter the object path of the file.Run the following commands to read the contents of a file.
exportBUCKET_NAME=<BUCKET_NAME> exportOBJECT_PATH=<OBJECT_PATH> curl --cacert /tmp/cacerts -v -X GET -H "Authorization: Bearer ${PRIVACERA_TOKEN}" -H "p-request-type:GCP_GCS""${DATASERVER_URL}/storage/v1/b/${BUCKET_NAME}/o/${OBJECT_PATH}?project=${GCP_PROJECT_NAME}&alt=media"
Upload file
SSH to the instance where Privacera GCP DataServer is installed or open a terminal on your local machine.
Get the following details for the API:
<BUCKET_NAME>
- Enter the bucket name where the file is stored.<FILE_NAME>
- Enter the name to be given for the uploaded file.<FILE_TO_UPLOAD>
- Enter the file to be uploaded.<FILE_CONTENT_TYPE>
- Enter the type of the file being uploaded.Run the following commands to upload a file.
exportBUCKET_NAME=<BUCKET_NAME> exportFILE_NAME=<FILE_NAME> exportFILE_TO_UPLOAD=<FILE_TO_UPLOAD> exportFILE_CONTENT_TYPE=<FILE_CONTENT_TYPE> curl -k --cacert /tmp/cacerts -v -X POST -H "Authorization: Bearer ${PRIVACERA_TOKEN}" -H "p-request-type:GCP_GCS""${DATASERVER_URL}/upload/storage/v1/b/${BUCKET_NAME}/o?project=${GCP_PROJECT_NAME}&uploadType=media&name=${FILE_NAME}" --data "@${FILE_TO_UPLOAD}" -H "Content-Type: ${FILE_CONTENT_TYPE}"
Delete file
SSH to the instance where Privacera GCP DataServer is installed or open a terminal on your local machine.
Get the following details for the API:
<BUCKET_NAME>
- Enter the bucket name where the file is stored.<FILE_NAME>
- Enter the name of the file to be deleted.Run the following commands to delete a file.
exportBUCKET_NAME=<BUCKET_NAME> exportFILE_NAME=<FILE_NAME> curl -k --cacert /tmp/cacerts -v -X DELETE -H "Authorization: Bearer ${PRIVACERA_TOKEN}" POST -H "p-request-type:GCP_GCS""${DATASERVER_URL}/storage/v1/b/${BUCKET_NAME}/o/${FILE_NAME}?project=${GCP_PROJECT_NAME}"