All Products
Search

This Product

    E-MapReduce:Configure Ranger access control for Hive

    Document Center

    E-MapReduce:Configure Ranger access control for Hive

    Last Updated:Jul 31, 2026

    This topic explains how to enable Ranger access control for Hive and provides examples of how to configure Ranger Hive permissions.

    Prerequisites

    You have created a DataLake cluster and selected the Ranger service. For more information, see Create a cluster.

    Usage notes

    After Ranger access control is enabled for Hive, the HiveServer2 service loads the Ranger Hive plugin. Ranger performs permission verification only when you submit SQL jobs through HiveServer2. Accessing Hive in other ways does not trigger this verification.

    • Supported access methods for permission verification

      • Accessing HiveServer2 by using a Beeline client.

      • Connecting to HiveServer2 by using a JDBC URL.

    • Unsupported access methods for permission verification

      • Connecting directly to the Metastore by using a Hive client.

      • Connecting directly to the Metastore by using the Hive-Client API.

    Important

    Ranger access control applies only to the Hive metadata and SQL operation layer. Ranger does not support access control for the OSS or OSS-HDFS storage layer. Do not configure storage-layer permission policies in Ranger, as they will not take effect.

    Procedure

    1. Go to the Cluster Service page.

      1. Log on to the EMR on ECS console.

      2. In the top navigation bar, select a region and a resource group based on your requirements.

      3. In the Actions column of the target cluster, click Services.

    2. Enable Hive in Ranger.

      1. On the Services page, find the Ranger-plugin service and click its Status.

      2. In the Service Overview section, turn on the enableHive ranger switch.

      3. In the dialog box that appears, click OK.

    3. Restart HiveServer.

      1. On the Services page, select more > Hive.

      2. In the Components section, click Restart in the Actions column of HiveServer.

      3. In the dialog box that appears, enter an Execution Reason and click OK.

      4. In the Confirm dialog box, click OK.

    Permission configuration

    Overview

    Ranger permissions are configured in the Ranger UI. For instructions on accessing the Ranger UI, see Ranger overview.

    To configure Hive permissions in Ranger, click emr-hive under HADOOP SQL. After opening the Ranger Service Manager page, you can find the created emr-hive service instance under the HADOOP SQL category. You can view, edit, or delete this service instance.

    If the emr-hive service is not displayed in the Ranger UI, perform the following steps:

    1. Log on to the EMR on ECS console.

    2. On the cluster service page, find the Ranger-plugin service and click Status to open the configuration page.

    3. Search for the enableImpala parameter and set its value to true.

    4. Save the configuration.

    5. Refresh the Ranger UI page. The emr-hive service should now appear under HADOOP SQL.

    After you open the emr-hive service, you can see a list of all configured permission policies. By default, Ranger includes several policies. For example, one default policy grants the hive user (the startup user for the HiveServer service) full access to all database, table, column, UDF, and URL resources. Another default policy grants all users the create permission for databases and for resources within the default database.

    Add a permission policy

    Click Add New Policy in the upper-right corner to add a permission policy. A policy requires a unique Policy Name. A basic policy consists of three main components: resources, users, and permissions. Resources are the assets the policy governs, such as a database, table, column, or URL. Users are the accounts the policy applies to. Permissions are the types of access granted.

    • Policy resources

      In Ranger for Hive, policy resources include database, table, column, url, and udf. You can select a resource type to configure its permissions. By default, the policy form displays fields for database, table, and column. You can click the name of a resource to switch to another type.

      When you configure a policy, you must enter the name of the resource. For example, you can enter testdb for database, test for table, id for column, or oss://test-bucket/test/tmp for url. You can also enter an asterisk (*) to match all resources of that type. Each resource configuration row contains a resource type dropdown (such as column), a value input field (required), and an Include toggle to specify whether to include or exclude the resource.

    • Policy users

      A policy must apply to specific users. You can select the users from the Select User list. In the Select User dialog box, select the user to authorize (for example, test).

    • Policy permissions

      Click Add Permissions to display the add/edit permissions section. In the add/edit permissions panel, select the required permissions (for example, Select and Create), then click Add to confirm.

    Example 1: Column-level permissions

    A common use case for Ranger access control is to grant a specific user the select permission on a table. This ensures that the user can run select columns from table queries. Configure the Ranger policy with the following field values:

    • Policy Name: select-permission-example

    • database: testdb (Include)

    • table: test (Include)

    • column: id (Include)

    • Audit Logging: Yes

    • Allow Conditions: Select User is test, Permissions is select

    This policy grants the test user the select permission on column=id in table=test within database=testdb. This allows the user to run the select id from testdb.test query. To allow a user to select all columns from testdb.test, set the column field to *.

    Example 2: Table-level permissions

    In Ranger for Hive, the create permission for tables can be configured at the table level. For example, if you grant the create permission for database=testdb, table=test, and column=*, the user can create only the table named test. The user cannot create other tables. To allow a user to create any table in a database, grant the create permission for database=testdb, table=*, and column=*.

    Create an access policy in Apache Ranger with the following key configurations:

    • Policy Name: create-permission-example

    • Policy Type: Access

    • database: testdb (Include enabled)

    • table: * (Include enabled)

    • column: * (Include enabled)

    • Audit Logging: Yes

    In the Allow Conditions section, set Select User to test and Permissions to Create.

    Example 3: URL permissions

    When you run a Hive SQL statement that includes a LOCATION clause with an oss scheme, Ranger verifies the user's read and write permissions for that URL. For example, running create external table test(id int, name string) location 'oss://test-bucket/test' triggers a permission check for read access on oss://test-bucket/test.

    In this case, you must configure a policy for the URL permission. To switch the resource type to url, see the instructions in the "Add a permission policy" section. Edit the policy for the emr-hive service in Ranger with the following key configurations:

    • Policy Name: url-permission-example

    • Resource type: url, value: oss://test-bucket/test, with Recursive enabled

    • Allow Conditions: User is test, Permissions is Read

    If you do not need to control URL permissions, you can also modify the policy for all - url in the default permission Policy Name and add public to Select Group. This grants all users read and write permissions for all URLs.

    Note

    In Ranger, public is a special group that represents all users. When a policy's Select Group is set to public, the permissions in that policy apply to all users.

    FAQ

    How do I configure Ranger Hive permissions for a read-only account?

    To grant a read-only account only the select permission on specific Hive resources, create a Ranger policy by performing the following steps:

    1. In the Ranger UI, click emr-hive under HADOOP SQL to open the Hive policy list.

    2. Click Add New Policy in the upper-right corner.

    3. Configure the policy resources:

      • database: Enter the name of the target database, or enter * to match all databases.

      • table: Enter the name of the target table, or enter * to match all tables.

      • column: Enter * to match all columns, or specify individual column names.

    4. In the Select User field, select the read-only account.

    5. Click Add Permissions, and select only the select permission.

    6. Click Add to save the policy.

    If you are unsure which account to specify, you can select all users from the Select User dropdown list, or check the Ranger audit logs to identify the accounts that have previously connected to Hive.

    Does EMR 4.9.0 support using Ranger to control Impala permissions?

    No. EMR 4.9.0 does not support using Ranger to control Impala permissions. To use Ranger for Impala access control, upgrade your cluster to a later EMR version that supports this feature, or use an alternative permission management solution.