All Products
Search

This Product

    E-MapReduce:Configure security zones

    Document Center

    E-MapReduce:Configure security zones

    Last Updated:Mar 26, 2026

    Security zones in Apache Ranger 2.1.0 and later let you partition resources across departments and assign dedicated administrators to each zone. Zone administrators control permissions only within their own zone, keeping resource access management isolated and scalable.

    This topic describes how to create security zone administrators, configure security zones, and verify that zone isolation works correctly.

    Prerequisites

    Before you begin, ensure that you have:

    Limitations

    Security zones are supported only in EMR V5.X.

    How it works

    When a Ranger plug-in evaluates an access request, it identifies the security zone that the requested resource belongs to:

    • Resource belongs to a security zone: Only the policies configured in that security zone apply. Policies from other security zones are ignored.

    • Resource does not belong to any security zone: Ranger falls back to the default (unnamed) zone and applies policies that are not scoped to a specific security zone.

    Each security zone has two levels of administrators:

    • Zone administrators: Manage policies only within their assigned security zone. Attempting to configure policies for resources in another zone has no effect.

    • Super administrators: Created with the Admin role in Ranger. Can configure policies across all resources in all security zones.

    Example scenario

    A company has two departments. Department A uses Hive database a and HDFS path /a. Department B uses Hive database b and HDFS path /b. The two security zones are configured as follows:

    Zone: a
  service: emr-hive; path=/a/*
  service: emr-hdfs; database=a

Zone: b
  service: emr-hive; path=/b/*
  service: emr-hdfs; database=b

    Each department's administrator manages permissions only within their own zone.

    Create security zone administrators

    The following steps create admin_a and admin_b as zone administrators.

    1. Access the Ranger web UI. See Access the web UI of Ranger.

    2. In the top navigation bar, choose Settings > Users/Groups/Roles.

    3. On the Users tab, click Add New User.

      Add User

    4. On the User Detail page, enter the user information, set Select Role to User, and click Save.

      Important

      Set Select Role to User, not Admin. Setting this parameter to Admin creates a super administrator who can configure policies across all security zones.

    Repeat these steps to create both admin_a and admin_b.

    Configure security zones

    The following steps configure Security Zone a and Security Zone b. Repeat the steps for each zone.

    1. Access the Ranger web UI. See Access the web UI of Ranger.

    2. In the top navigation bar, click Security Zone.

    3. On the Security Zone page, click the add icon in the Security Zones section.

      Add Zone

    4. On the Create Zone page, configure the following parameters.

      Zone Edit

      ParameterDescriptionExample
      Zone NameThe name of the security zone.a
      Admin UsersThe zone administrators. Must be users with Select Role set to User in the Settings module (not Admin). See Create security zone administrators.admin and admin_a
      Auditor UsersThe users who are allowed to view the audit logs of the security zone.admin and admin_a
      Select Resource ServicesThe Ranger services whose resources you want to include in this security zone.emr-hive and emr-hdfs
      ResourceThe specific resources to allocate to the security zone.database=a and path=/a/*

    5. Click Save.

    Repeat steps 3 through 5 to configure Security Zone b.

    Verify security zone isolation

    1. Log on to the Ranger web UI as admin_a. See Access the web UI of Ranger.

    2. In the upper-right corner, select a in the Security Zone section.

    3. Click emr-hive. As admin_a, you can view and modify only the policies in Security Zone a. To verify isolation, grant the test user SELECT permissions on a table in Hive Database b, then run the query using Beeline. The permission has no effect because Hive Database b belongs to Security Zone b. Ranger evaluates the request using Security Zone b policies only.

      zone_a

    4. Log on to the Ranger web UI as admin_b. See Access the Ranger UI.

    5. In the upper-right corner, select b in the Security Zone section.

    6. Click emr-hive. Grant the test user SELECT permissions on a table in Hive Database b, then run the query using Beeline. The permission takes effect because admin_b is configuring policies within Security Zone b, where Database b belongs.

      zone_b