Cloudera Data Platform Security and Governance
The Security and Governance domain tests authentication, authorization, auditing, encryption, and metadata governance across CDP. It covers Kerberos, Ranger policies, Atlas classifications, HDFS ACLs, TLS, and transparent data encryption, plus SDX constructs in CDP Public Cloud.
Authentication
- Kerberos is the core authentication protocol. Services use keytabs; users obtain tickets with
kinit. Clocks must be synchronized within the Kerberos tolerance, and reverse DNS must resolve correctly. - Web interfaces commonly use LDAP or SAML. Knox provides an edge gateway. Long-running jobs use delegation tokens rather than interactive tickets.
Authorization and governance
- Ranger is the central policy engine for HDFS, Hive, Impala, YARN, Kafka, and other services. Policies bind resources, users or groups, permissions, allow or deny conditions, and audit settings.
- Ranger deny policies take precedence over allow policies. HDFS ACLs and POSIX permissions still matter for direct filesystem access; granting a Hive table does not grant the underlying HDFS path.
- Hive column masking and row filters are Ranger policies. Impala enforces Ranger Hive policies as well.
- Atlas records lineage, classifications, and business metadata. Tag-based Ranger policies use Atlas classifications, but classification alone does not enforce access.
- In CDP Public Cloud, SDX provides the shared Data Lake governance layer with Ranger and Atlas for attached Data Hub clusters. CDP Private Cloud Base uses Ranger and Atlas directly.
Encryption and auditing
- TLS protects data in transit; mismatched TLS settings between roles cause connection failures. HDFS transparent data encryption uses encryption zones and a KMS.
- Ranger audit records policy decisions. Audit logs are essential when a user reports an unexpected denial.
Worked example
An analyst can query a Hive table but must not see a credit_card column. Reasoning: classify the column as PII in Atlas, create a Ranger masking policy or tag-based policy, and confirm Atlas-Ranger integration. Test with beeline; if the column still appears, check group membership, policy priority, and audit logs. A HDFS-only grant would not solve this.
Traps
- Granting HDFS path access but no Hive or Impala grant, or the reverse.
- Assuming an Atlas classification enforces masking without a Ranger policy.
- Forgetting that deny policies override allows.
- Using a keytab with incorrect permissions or an expired ticket.