59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
# =============================================================================
|
|
# SiCABE — Model Authorization (SUMBER KEBENARAN) — OPA / Trino
|
|
# -----------------------------------------------------------------------------
|
|
# Berkas ini SATU-SATUNYA sumber kebenaran ACL. JANGAN mengedit
|
|
# config/opa/data.json manual — itu HASIL RENDER:
|
|
# ./scripts/sicabe-authz render # authz.yml -> data.json
|
|
# ./scripts/sicabe-authz apply # render + reload OPA
|
|
# ./scripts/sicabe-authz fmt # rapikan format berkas ini
|
|
# Policy Rego membaca data.authz.catalogs / data.authz.write_schemas — nama
|
|
# catalog/schema TIDAK di-hardcode di Rego. Ganti nama catalog = ubah `catalogs:`
|
|
# di sini -> render -> reload. Dokumentasi: docs/authorization-cli.md
|
|
# =============================================================================
|
|
version: 1
|
|
catalogs: [iceberg]
|
|
schemas: [bronze, silver, gold]
|
|
roles:
|
|
data-admin: {superuser: true}
|
|
data-engineer:
|
|
grants:
|
|
- table: bronze.orders
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- table: bronze.orders_incremental
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- table: silver.orders_silver
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- table: gold.orders_gold
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
data-catalog:
|
|
grants:
|
|
- table: bronze.orders
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: bronze.orders_incremental
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: silver.orders_silver
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: silver.orders_clean
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: gold.orders_gold
|
|
caps: [select]
|
|
columns: '*'
|
|
data-analyst:
|
|
grants:
|
|
- table: gold.orders_gold
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: silver.orders_silver
|
|
caps: [select]
|
|
columns: [id, total_value]
|
|
data-viewer: {}
|
|
users: {svc_dbt: data-engineer, svc_airflow: data-engineer, svc_seed: data-engineer, svc_om: data-catalog}
|