Policy-Based Security

In HPE Ezmeral Runtime Enterprise, HPE Ezmeral Data Fabric on Kubernetes supports policy-based security (PBS), and the creation and management of security policies for Data Fabric objects through maprcli commands. For some tasks, you can also use the Control System (MCS).

A security policy is a classification that encapsulates security controls on data. Security controls define which users are authorized to access and modify data objects, whether to audit data operations, and whether to protect data in motion with wire-level encryption.

For example, consider a scenario in which one of your data classifications is sensitive employee data. With policy-based security, you can create a security policy named employeeData. As part of the security policy, one of the security controls you might define includes access control expressions (ACEs) that specify which users are allowed to access the employee data. You can then apply the security policy to relevant employee data objects. When you need to grant new users access to the employee data, you only need to modify that one security policy instead of modifying the ACEs defined on each of the employee data objects.

Examples of HPE Ezmeral Data Fabric objects that can be assigned ("tagged" with) security policies include the following:

• HPE Ezmeral Data Fabric file system volumes, directories and files
• HPE Ezmeral Data Fabric Database JSON tables, column families, and fields

For more information about policy-based security (PBS) for HPE Ezmeral Data Fabric, see Policy-Based Security in the HPE Ezmeral Data Fabric documentation.