cloudera.services.ranger_policy module – Manage policies in Apache Ranger

Note

This module is part of the cloudera.services collection (version 1.0.0).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install git+https://github.com/cloudera-labs/cloudera.services.git.

To use it in a playbook, specify: cloudera.services.ranger_policy.

New in cloudera.services 1.1.0

Synopsis

• Create, update, or delete policies in Apache Ranger.

Parameters

Parameter	Comments
additional_resources list / elements=dictionary	Additional resource definitions.
allow_exceptions list / elements=dictionary	List of allow exception policy items.
accesses list / elements=dictionary	List of access types and whether each is allowed.
is_allowed boolean	Whether this access type is allowed. Choices: false true
type string / required	The access type (e.g. read, write, select).
conditions list / elements=dictionary	List of custom conditions for the policy item.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Choices: false true
groups list / elements=string	List of groups the policy item applies to.
roles list / elements=string	List of roles the policy item applies to.
users list / elements=string	List of users the policy item applies to.
client_cert path	The path to a client certificate for authenticating to the API endpoint.
client_key path	The path to a client key for authenticating to the API endpoint.
conditions list / elements=dictionary	List of custom conditions for the policy.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
data_mask_policy_items aliases: data_mask_policies list / elements=dictionary	List of data masking policy items.
accesses list / elements=dictionary	List of access types and whether each is allowed.
is_allowed boolean	Whether this access type is allowed. Choices: false true
type string / required	The access type (e.g. read, write, select).
conditions list / elements=dictionary	List of custom conditions for the policy item.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
data_mask_info dictionary	The data masking configuration to apply.
condition_expr string	The condition expression controlling when the mask applies.
data_mask_type string	The type of data masking to apply.
value_expr string	The expression used to compute the masked value.
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Choices: false true
groups list / elements=string	List of groups the policy item applies to.
roles list / elements=string	List of roles the policy item applies to.
users list / elements=string	List of users the policy item applies to.
debug aliases: debug_endpoints boolean	A flag to enable debug logging of the module’s execution. Choices: false ← (default) true
deny_exceptions list / elements=dictionary	List of deny exception policy items.
accesses list / elements=dictionary	List of access types and whether each is allowed.
is_allowed boolean	Whether this access type is allowed. Choices: false true
type string / required	The access type (e.g. read, write, select).
conditions list / elements=dictionary	List of custom conditions for the policy item.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Choices: false true
groups list / elements=string	List of groups the policy item applies to.
roles list / elements=string	List of roles the policy item applies to.
users list / elements=string	List of users the policy item applies to.
deny_policy_items aliases: deny_policies list / elements=dictionary	List of deny policy items.
accesses list / elements=dictionary	List of access types and whether each is allowed.
is_allowed boolean	Whether this access type is allowed. Choices: false true
type string / required	The access type (e.g. read, write, select).
conditions list / elements=dictionary	List of custom conditions for the policy item.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Choices: false true
groups list / elements=string	List of groups the policy item applies to.
roles list / elements=string	List of roles the policy item applies to.
users list / elements=string	List of users the policy item applies to.
description string	Description of the policy.
force boolean	A flag to force a refresh of the API request, ignoring any cached results. Choices: false ← (default) true
force_basic_auth boolean	A flag to force basic authentication for API requests. Choices: false ← (default) true
http_agent aliases: user_agent string	The User-Agent string to send with API requests. Default: "cloudera-services-module"
is_audit_enabled aliases: audit_enabled boolean	Whether auditing is enabled for the policy. Choices: false true
is_deny_all_else aliases: deny_all_else boolean	Whether to deny all other accesses not explicitly allowed by the policy. Choices: false true
is_enabled aliases: enabled boolean	Whether the policy is enabled. Choices: false true
merged boolean	Whether to merge the provided policy items with the existing policy or replace it entirely. When true, the module adds new users, groups, and accesses to existing policy items by concatenating lists. When false, the module performs a full replacement (the default behavior). Choices: false ← (default) true
name string	Name of the policy.
options dictionary	Dictionary of additional options for the policy.
page_size aliases: default_page_size integer	The number of items to return per page in a paginated API response. Default: 100
policy_items aliases: access_policies list / elements=dictionary	List of allow policy items.
accesses list / elements=dictionary	List of access types and whether each is allowed.
is_allowed boolean	Whether this access type is allowed. Choices: false true
type string / required	The access type (e.g. read, write, select).
conditions list / elements=dictionary	List of custom conditions for the policy item.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Choices: false true
groups list / elements=string	List of groups the policy item applies to.
roles list / elements=string	List of roles the policy item applies to.
users list / elements=string	List of users the policy item applies to.
policy_labels list / elements=string	List of labels associated with the policy.
policy_priority integer	Priority of the policy.
policy_type integer	Type of the policy.
resources dictionary	Dictionary of resource definitions for the policy.
row_filter_policy_items aliases: row_filter_policies list / elements=dictionary	List of row filtering policy items.
accesses list / elements=dictionary	List of access types and whether each is allowed.
is_allowed boolean	Whether this access type is allowed. Choices: false true
type string / required	The access type (e.g. read, write, select).
conditions list / elements=dictionary	List of custom conditions for the policy item.
type string / required	The type of the condition.
values list / elements=string	The values associated with the condition.
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Choices: false true
groups list / elements=string	List of groups the policy item applies to.
roles list / elements=string	List of roles the policy item applies to.
row_filter_info dictionary	The row filter configuration to apply.
filter_expr string	The filter expression applied to rows.
users list / elements=string	List of users the policy item applies to.
service string	Name of the Ranger service associated with the policy.
service_type string	Type of the service (e.g., hive, hdfs) this policy applies to.
state string	Whether the policy should be present or absent. Choices: "present" ← (default) "absent"
timeout aliases: timeout_seconds integer	The timeout in seconds for any API requests. Default: 60
url aliases: endpoint, endpoint_url string / required	The base URL of the API endpoint, including the port if necessary.
url_password string	The password for authenticating to the API endpoint.
url_username string	The username for authenticating to the API endpoint.
use_gssapi boolean	A flag to enable or disable GSSAPI authentication for API requests. Choices: false ← (default) true
use_proxy boolean	A flag to enable or disable the use of a proxy for API requests. Choices: false true ← (default)
validate_certs boolean	A flag to enable or disable SSL certificate validation for API requests. Choices: false true ← (default)
validity_schedules list / elements=dictionary	Time-based policy schedules.
end_time string	The end time of the validity schedule.
recurrences list / elements=dictionary	List of recurrence definitions for the schedule.
interval dictionary	The recurrence interval definition.
schedule dictionary	The recurrence schedule definition.
start_time string	The start time of the validity schedule.
time_zone string	The time zone the schedule times are expressed in.
zone_name string	Name of the security zone the policy belongs to.

Attributes

Attribute	Support	Description
check_mode	Support: full	This module supports check mode.
diff_mode	Support: full	This module supports diff mode.

Notes

Note

• When merged=false (default), the module performs full replacements of existing policies rather than merges.

• If the desired state differs from the current policy, the existing policy is fully overwritten with the new definition.

• This guarantees consistent, predictable updates and avoids the risk of duplicate or conflicting entries.

• When merged=true, the module concatenates lists (users, groups, accesses) with the existing ones.

• Merge mode is useful for adding users, groups, or accesses to existing policies without specifying all current values.

• Values already present are not duplicated when merging.

Examples

# NOTE: Examples do not include connection and authentication fields


- name: Create a basic Ranger policy
  cloudera.services.ranger_policy:
    name: "Test Policy 2"
    service: "cm_hdfs"
    service_type: "hdfs"
    description: "Description1"
    resources:
      path:
        values:
          - "/hbase/archive2"

- name: Update an existing Ranger policy
  cloudera.services.ranger_policy:
    name: "Policy test create request"
    service: "cm_hdfs"
    resources:
      path:
        values:
          - "/tmp/test"

- name: Create a policy with users, groups, and multiple accesses
  cloudera.services.ranger_policy:
    name: "atlas-policy"
    service: "cm_atlas"
    resources:
      entity-type:
        values:
          - "hive_table"
    access_policies:
      - accesses:
          - type: "type-create"
            is_allowed: true
          - type: "type-read"
            is_allowed: true
        users:
          - "admin"
          - "impala"
          - "flink"
          - "zookeeper"
        groups:
          - "public"
        roles: []
        conditions: []

- name: Add a user to an existing policy using merge mode
  cloudera.services.ranger_policy:
    name: "all - database, table"
    service: "cm_kudu"
    merged: true
    access_policies:
      - users:
          - "kafka"
        accesses:
          - type: "select"
            is_allowed: true

- name: Delete a Ranger policy
  cloudera.services.ranger_policy:
    name: "Test Policy 6"
    service: "cm_hdfs"
    state: "absent"

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key	Description
policy dictionary	A dictionary containing details about the policy. Returned: always
additional_resources list / elements=dictionary	List of additional resource definitions. Returned: always
is_excludes boolean	Whether the specified values are excluded rather than included. Returned: always
is_recursive boolean	Whether the resource match is applied recursively. Returned: always
values list / elements=string	List of resource values matched by this resource definition. Returned: always
allow_exceptions list / elements=dictionary	List of allow exception policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
conditions list / elements=dictionary	List of policy conditions. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
create_time integer	Epoch timestamp when the policy was created. Returned: always
created_by string	Username of the policy creator. Returned: always
data_mask_policy_items list / elements=dictionary	List of data mask policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
data_mask_info dictionary	The data masking configuration applied by this policy item. Returned: always
condition_expr string	The condition expression controlling when the mask applies. Returned: always
data_mask_type string	The type of data masking to apply. Returned: always
value_expr string	The expression used to compute the masked value. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
deny_exceptions list / elements=dictionary	List of deny exception policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
deny_policy_items list / elements=dictionary	List of deny policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
description string	Optional description of the policy. Returned: always
guid string	Globally unique identifier for the policy. Returned: always
id integer	Unique numeric ID of the policy. Returned: always
is_audit_enabled boolean	Whether auditing is enabled for the policy. Returned: always
is_deny_all_else boolean	Whether the policy denies all accesses not explicitly allowed. Returned: always
is_enabled boolean	Whether the policy is currently enabled. Returned: always
name string	Name of the policy. Returned: always
options dictionary	Dictionary of additional policy options. Returned: always
policy_items list / elements=dictionary	List of allow policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
policy_labels list / elements=string	List of policy labels. Returned: always
policy_priority integer	Priority value for the policy. Returned: always
policy_type integer	Numeric identifier for the type of policy. Returned: always
resource_signature string	Signature hash of the resources in the policy. Returned: always
resources dictionary	Dictionary of resources the policy applies to. Returned: always
is_excludes boolean	Whether the specified values are excluded rather than included. Returned: always
is_recursive boolean	Whether the resource match is applied recursively. Returned: always
values list / elements=string	List of resource values matched by this resource definition. Returned: always
row_filter_policy_items list / elements=dictionary	List of row filter policy items. Returned: always
accesses list / elements=dictionary	List of access types and whether each is allowed. Returned: always
is_allowed boolean	Whether this access type is allowed. Returned: always
type string	The access type (e.g. read, write, select). Returned: always
conditions list / elements=dictionary	List of custom conditions for the policy item. Returned: always
type string	The type of the condition. Returned: always
values list / elements=string	The values associated with the condition. Returned: always
delegate_admin boolean	Whether users/groups of this policy item are allowed to update the policy. Returned: always
groups list / elements=string	List of groups the policy item applies to. Returned: always
roles list / elements=string	List of roles the policy item applies to. Returned: always
row_filter_info dictionary	The row filter configuration applied by this policy item. Returned: always
filter_expr string	The filter expression applied to rows. Returned: always
users list / elements=string	List of users the policy item applies to. Returned: always
service string	Name of the service this policy applies to. Returned: always
service_type string	Type of the service (e.g., hive, hdfs) this policy applies to. Returned: always
update_time integer	Epoch timestamp when the policy was last updated. Returned: always
updated_by string	Username of the last person who updated the policy. Returned: always
validity_schedules list / elements=dictionary	List of validity schedules attached to the policy. Returned: always
end_time string	The end time of the validity schedule. Returned: always
recurrences list / elements=dictionary	List of recurrence definitions for the schedule. Returned: always
interval dictionary	The recurrence interval definition. Returned: always
schedule dictionary	The recurrence schedule definition. Returned: always
start_time string	The start time of the validity schedule. Returned: always
time_zone string	The time zone the schedule times are expressed in. Returned: always
version integer	Version number of the policy. Returned: always
zone_name string	Name of the security zone this policy belongs to. Returned: always

Authors

• Ronald Suplina (@rsuplina)

Collection Links

• Issue Tracker
• Repository (Sources)
• Submit a bug report
• Request a feature