ECS 3.6.2 Data Access Guide

Secure the bucket

In addition to configuring a bucket ACL, the root directory entry should be created and secured immediately after bucket creation.

1. Set the mode bits in the root directory object ACL so that only the bucket owner and the default group have access to the bucket. The other group, which includes all ECS HDFS client users, is not allowed access the root directory, and therefore it is not allowed access to any files in the bucket.

   [hdfs@hadoop-0 ~]$
   fs=viprfs://bucket.ns.fed
   hadoop fs -chmod 750 $fs/
   hadoop fs -chown hdfs:hdfs $fs/

2. Specific groups and users should be added to the root directory object ACL using the setfacl command.
   Note that these permissions duplicate the bucket's Custom Group ACLs to ensure that all HDFS APIs have the same effective permissions.

   hadoop fs -setfacl -m group:hadoop:r-x $fs/
   hadoop fs -setfacl -m group:users:r-x $fs/
   hadoop fs -setfacl -m group:hive:r-x $fs/
   hadoop fs -setfacl -m group:spark:r-x $fs/
   

3. Confirm the permissions.

   hadoop fs -ls -d $fs/
   drwxr-x---+ - hdfs hdfs 0 2017-08-22 20:44 viprfs://bucket.ns.fed/
   

   hadoop fs -getfacl $fs/
   # file: viprfs://bucket.ns.fed/
   # owner: hdfs
   # group: hdfs
   user::rwx
   group::r-x
   group:hadoop:r-x
   group:hive:r-x
   group:spark:r-x
   group:users:r-x
   mask::r-x
   other::---