blob: 1b05c6abe59df3defb3766a8e2cbf5d9fb56896c [file] [log] [blame]
<?xml version="1.0" encoding="UTF-8"?>
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
<!DOCTYPE concept PUBLIC "-//OASIS//DTD DITA Concept//EN" "concept.dtd">
<concept rev="2.0.0" id="grant">
<title>GRANT Statement (<keyword keyref="impala20"/> or higher only)</title>
<titlealts audience="PDF">
<data name="Category" value="Impala"/>
<data name="Category" value="DDL"/>
<data name="Category" value="SQL"/>
<data name="Category" value="Security"/>
<data name="Category" value="Sentry"/>
<data name="Category" value="Roles"/>
<data name="Category" value="Administrators"/>
<data name="Category" value="Developers"/>
<data name="Category" value="Data Analysts"/>
<!-- Consider whether to go deeper into categories like Security for the Sentry-related statements. -->
<p rev="2.0.0">
The <codeph>GRANT</codeph> statement grants a privilege on a specified object to a role,
to a user, or to a group. The statement is also used to grant a role to a group.
<p conref="../shared/impala_common.xml#common/syntax_blurb"/>
The following syntax is supported when Impala is using Sentry to manage authorization.
<codeblock rev="2.3.0 collevelauth">GRANT ROLE <varname>role_name</varname> TO GROUP <varname>group_name</varname>
GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
TO [ROLE] <varname>role_name</varname>
<ph id="privileges" rev="3.0"><varname>privilege</varname> ::= ALL | ALTER | CREATE | DROP | INSERT | REFRESH | SELECT | SELECT(<varname>column_name</varname>)</ph>
<ph id="priv_objs" rev="3.0"><varname>object_type</varname> ::= SERVER | URI | DATABASE | TABLE</ph>
The following syntax is supported when Impala is using Ranger to manage authorization.
<codeblock>GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
TO USER <varname>user_name</varname>
GRANT <varname>privilege</varname> ON <varname>object_type</varname> <varname>object_name</varname>
TO GROUP <varname>group_name</varname>
<ph rev="3.0">privilege ::= ALL | ALTER | CREATE | DROP | INSERT | REFRESH | SELECT | SELECT(<varname>column_name</varname>)</ph>
<ph rev="3.0">object_type ::= SERVER | URI | DATABASE | TABLE</ph></codeblock>
Typically, the <codeph><varname>object_name</varname></codeph> is an identifier. For URIs,
it is a string literal.
<p conref="../shared/impala_common.xml#common/privileges_blurb"/>
Only administrative users (initially, a predefined set of users specified in the Sentry
service configuration file) can use this statement.
Only Sentry administrative users can grant roles to a group.
The <codeph>WITH GRANT OPTION</codeph> clause allows members of the specified role to
issue <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements for those same
privileges. Hence, if a role has the <codeph>ALL</codeph> privilege on a database and the
<codeph>WITH GRANT OPTION</codeph> set, users granted that role can execute
<codeph>GRANT</codeph>/<codeph>REVOKE</codeph> statements only for that database or child
tables of the database. This means a user could revoke the privileges of the user that
provided them the <codeph>GRANT OPTION</codeph>.
<p rev="2.3.0 collevelauth">
The ability to grant or revoke <codeph>SELECT</codeph> privilege on specific columns is
available in <keyword keyref="impala23_full"/> and higher. See
keyref="sg_hive_sql"/> for details.
<b>Usage notes:</b>
You can only grant the <codeph>ALL</codeph> privilege to the <codeph>URI</codeph> object.
Finer-grained privileges mentioned below on a <codeph>URI</codeph> are not supported.
<p conref="../shared/impala_common.xml#common/privileges_objects"/>
<p conref="../shared/impala_common.xml#common/compatibility_blurb"/>
The Impala <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements are available
in <keyword keyref="impala20_full"/> and later.
In <keyword keyref="impala14_full"/> and later, Impala can make use of any roles and
privileges specified by the <codeph>GRANT</codeph> and <codeph>REVOKE</codeph>
statements in Hive, when your system is configured to use the Sentry service instead
of the file-based policy mechanism.
The Impala <codeph>GRANT</codeph> and <codeph>REVOKE</codeph> statements for
privileges do not require the <codeph>ROLE</codeph> keyword to be repeated before each
role name, unlike the equivalent Hive statements.
<li conref="../shared/impala_common.xml#common/grant_revoke_single"/>
<p conref="../shared/impala_common.xml#common/cancel_blurb_no"/>
<p conref="../shared/impala_common.xml#common/permissions_blurb_no"/>
<p conref="../shared/impala_common.xml#common/kudu_blurb"/>
<p conref="../shared/impala_common.xml#common/kudu_sentry_limitations"/>
<p conref="../shared/impala_common.xml#common/related_info"/>
<xref href="impala_authorization.xml#authorization"/>,
<xref href="impala_revoke.xml#revoke"/>,
<xref href="impala_create_role.xml#create_role"/>,
<xref href="impala_drop_role.xml#drop_role"/>, <xref href="impala_show.xml#show"/>