70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
# =============================================================================
|
|
# SiCABE — Model Authorization (SUMBER KEBENARAN) — OPA / Trino
|
|
# -----------------------------------------------------------------------------
|
|
# Berkas ini SATU-SATUNYA sumber kebenaran ACL. JANGAN mengedit
|
|
# config/opa/data.json manual — itu HASIL RENDER:
|
|
# ./scripts/sicabe-authz render # authz.yml -> data.json
|
|
# ./scripts/sicabe-authz apply # render + reload OPA
|
|
# ./scripts/sicabe-authz fmt # rapikan format berkas ini
|
|
# Policy Rego membaca data.authz.catalogs + grant schema (data.roles.<r>.schema_grants)
|
|
# — nama catalog/schema & cakupan GRANT TIDAK di-hardcode di Rego. Ganti nama
|
|
# catalog = ubah `catalogs:` di sini -> render -> reload. Grant tingkat-schema:
|
|
# `roles.<r>.schemas: [{schema, caps, columns}]`. Dokumentasi: docs/authorization-cli.md
|
|
# =============================================================================
|
|
version: 1
|
|
catalogs: [iceberg]
|
|
schemas: [bronze, silver, gold]
|
|
roles:
|
|
data-admin: {superuser: true}
|
|
data-engineer:
|
|
grants:
|
|
- table: bronze.orders
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- table: bronze.orders_incremental
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- table: silver.orders_silver
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- table: gold.orders_gold
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
schemas:
|
|
- schema: bronze
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- schema: silver
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
- schema: gold
|
|
caps: [select, write, ddl]
|
|
columns: '*'
|
|
data-catalog:
|
|
grants:
|
|
- table: bronze.orders
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: bronze.orders_incremental
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: silver.orders_silver
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: silver.orders_clean
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: gold.orders_gold
|
|
caps: [select]
|
|
columns: '*'
|
|
data-analyst:
|
|
grants:
|
|
- table: gold.orders_gold
|
|
caps: [select]
|
|
columns: '*'
|
|
- table: silver.orders_silver
|
|
caps: [select]
|
|
columns: [id, total_value]
|
|
data-viewer: {}
|
|
users: {svc_dbt: data-engineer, svc_airflow: data-engineer, svc_seed: data-engineer, svc_om: data-catalog}
|