How to set a role condition on a specific bucket#

#Objective

The Data Platform Identity Access Manager (IAM) allows you to set fine-grained conditions in your Project:

• on resources properties
• on users properties
• on data, through Advanced Data Access Control

The purpose of this tutorial is to show how to give users in your Project restricted access to only the Lakehouse Manager bucket called my_bucket.

#Requirements

You will need:

• an IAM role that grants access to the resource bucket (such as the default "DataStore Editor" role)

#Tutorial

To restrict access to specific buckets in your Lakehouse Manager, you must set a condition on the technical name when binding a role granting access to Data Store buckets.

Bind such a role to the group/user of your choice.

Then, add a condition to the role binding.

The condition must be set on the technical name of the resource, which intuitively would look like the following:

Name == "my_bucket"

However, just adding this condition would filter the entire role to the resources called "my_bucket", including resources that are not buckets (like queries, dashboards, pipelines, etc..). In other words, if your role gives access to any other resource, they will be filtered just like buckets.

Consequently, it is recommended to set conditions as follows.

#Using the visual builder

If your initial role grants access to other resources, it is important to start by adding a first rule which will allow access to all resources that are not buckets which are planned by the role.

• Field: Resource
• Operator: Not equals
• Value: Bucket

Then, add a branching with an OR operator.

In the branching, add two rules linked by an AND operator.

First rule:

• Field: Resource
• Operator: Equals
• Value: Bucket

Second rule:

• Field: Technical name
• Operator: Equals
• Value: my_bucket

Press Confirm. The user/group will now have access only to the bucket "my_bucket", and access to all other resources contained in the role.

#Using the CEL editor

In CEL, the condition would be the following:

Resource != "bucket"
||
(
  Resource == "bucket"
  &&
  Name == "my_bucket"
)

More!

Did you like this tutorial? Want more? Don't worry we got you covered, you can deep dive into the customization capabilities of the Identity Access Manager in our documentation!

Learn more about roles and conditions

Also, don't hesitate to get in touch if you need anything, our support & product team is dedicated to helping you deliver faster any AI applications you have in mind.

#Go further

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

Ask questions, give your feedback and interact directly with the team building the Data Platform on the dedicated Discord channel.

If you need support with your OVHcloud services, create a request in our Help Centre.

Join our community of users.