docs/topics/impala_grant.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
-->
<!DOCTYPE concept PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
<concept rev="2.0.0" id="grant">

  <title>GRANT Statement (<keyword keyref="impala20"/> or higher only)</title>

  <titlealts audience="PDF">

    <navtitle>GRANT</navtitle>

  </titlealts>

  <prolog>
    <metadata>
      <data name="Category" value="Impala"/>
      <data name="Category" value="DDL"/>
      <data name="Category" value="SQL"/>
      <data name="Category" value="Security"/>
      <data name="Category" value="Sentry"/>
      <data name="Category" value="Roles"/>
      <data name="Category" value="Administrators"/>
      <data name="Category" value="Developers"/>
      <data name="Category" value="Data Analysts"/>
<!-- Consider whether to go deeper into categories like Security for the Sentry-related statements. -->
    </metadata>
  </prolog>

  <conbody>

    <p rev="2.0.0">
      The <codeph>GRANT</codeph> statement grants a privilege on a specified object to a role,
      to a user, or to a group. The statement is also used to grant a role to a group.
    </p>

    <p conref="../shared/impala_common.xml#common/syntax_blurb"/>

    <p>
      The following syntax is supported when Impala is using Sentry to manage authorization.
    </p>

<codeblock rev="2.3.0 collevelauth">GRANT ROLE <varname>role_name</varname> TO GROUP <varname>group_name</varname>

GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
   TO [ROLE] <varname>role_name</varname>
   [WITH GRANT OPTION]

<ph id="privileges" rev="3.0"><varname>privilege</varname> ::= ALL | ALTER | CREATE | DROP | INSERT | REFRESH | SELECT | SELECT(<varname>column_name</varname>)</ph>
<ph id="priv_objs" rev="3.0"><varname>object_type</varname> ::= SERVER | URI | DATABASE | TABLE</ph>
</codeblock>

    <p>
      The following syntax is supported when Impala is using Ranger to manage authorization.
    </p>

<codeblock>GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
   TO USER <varname>user_name</varname>
GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
   TO GROUP <varname>group_name</varname>

<ph rev="3.0">privilege ::= ALL | ALTER | CREATE | DROP | INSERT | REFRESH | SELECT | SELECT(<varname>column_name</varname>)</ph>
<ph rev="3.0">object_type ::= SERVER | URI | DATABASE | TABLE</ph></codeblock>

    <p>
      Typically, the <codeph><varname>object_name</varname></codeph> is an identifier. For URIs,
      it is a string literal.
    </p>

    <p conref="../shared/impala_common.xml#common/privileges_blurb"/>

    <p>
      Only administrative users (initially, a predefined set of users specified in the Sentry
      service configuration file) can use this statement.
    </p>

    <p>
      Only Sentry administrative users can grant roles to a group.
    </p>

    <p>
      The <codeph>WITH GRANT OPTION</codeph> clause allows members of the specified role to
      issue <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements for those same
      privileges. Hence, if a role has the <codeph>ALL</codeph> privilege on a database and the
      <codeph>WITH GRANT OPTION</codeph> set, users granted that role can execute
      <codeph>GRANT</codeph>/<codeph>REVOKE</codeph> statements only for that database or child
      tables of the database. This means a user could revoke the privileges of the user that
      provided them the <codeph>GRANT OPTION</codeph>.
    </p>

    <p rev="2.3.0 collevelauth">
      The ability to grant or revoke <codeph>SELECT</codeph> privilege on specific columns is
      available in <keyword keyref="impala23_full"/> and higher. See
      <xref
        keyref="sg_hive_sql"/> for details.
    </p>

    <p>
      <b>Usage notes:</b>
    </p>

    <p>
      You can only grant the <codeph>ALL</codeph> privilege to the <codeph>URI</codeph> object.
      Finer-grained privileges mentioned below on a <codeph>URI</codeph> are not supported.
    </p>

    <p conref="../shared/impala_common.xml#common/privileges_objects"/>

    <p conref="../shared/impala_common.xml#common/compatibility_blurb"/>

    <p>
      <ul>
        <li>
          The Impala <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements are available
          in <keyword keyref="impala20_full"/> and later.
        </li>

        <li>
          In <keyword keyref="impala14_full"/> and later, Impala can make use of any roles and
          privileges specified by the <codeph>GRANT</codeph> and <codeph>REVOKE</codeph>
          statements in Hive, when your system is configured to use the Sentry service instead
          of the file-based policy mechanism.
        </li>

        <li>
          The Impala <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements for
          privileges do not require the <codeph>ROLE</codeph> keyword to be repeated before each
          role name, unlike the equivalent Hive statements.
        </li>

        <li conref="../shared/impala_common.xml#common/grant_revoke_single"/>
      </ul>
    </p>

    <p conref="../shared/impala_common.xml#common/cancel_blurb_no"/>

    <p conref="../shared/impala_common.xml#common/permissions_blurb_no"/>

    <p conref="../shared/impala_common.xml#common/kudu_blurb"/>

    <p conref="../shared/impala_common.xml#common/kudu_sentry_limitations"/>

    <p conref="../shared/impala_common.xml#common/related_info"/>

    <p>
      <xref href="impala_authorization.xml#authorization"/>,
      <xref href="impala_revoke.xml#revoke"/>,
      <xref href="impala_create_role.xml#create_role"/>,
      <xref href="impala_drop_role.xml#drop_role"/>, <xref href="impala_show.xml#show"/>
    </p>

  </conbody>

</concept>