Acceldata
 ODP
Search documentation… ⌘K

Ranger Limitations

This page lists the known limitations.

  • No active logging available for operations done with S3 buckets.
  • Ranger usernames must exactly match IAM usernames. AD/LDAP usernames are assumed to be available in AWS IAM.
  • Limited S3 actions supported. Currently supports core actions: ListBucket, GetObject, PutObject, DeleteObject
  • New S3 bucket creation from Ranger is not supported.
  • STS token authentication is not supported – Ranger cannot enforce policies on temporary credentials issued via AWS STS.
  • Reverse pushdown from S3 ACL/policy to Ranger is not supported – Ranger cannot automatically import existing S3 bucket policies or ACLs.
  • Existing S3 policies/ACLs handling:
    • When Ranger is configured to manage S3 buckets, it overwrites the existing resource-based S3 ACLs/policies for the given resource, based on the Ranger-defined policy settings.
    • Care should be taken to review S3 permissions before enabling Ranger pushdown to avoid unintended access changes.
  • AWS resource-based policies do not support using IAM groups as principals. Group mappings are only supported in identity-based AWS policies. Since Ranger relies on resource-based AWS policies, group-based mapping is not supported as part of this plugin. https://docs.aws.amazon.com/AmazonS3/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies