Attribute-based access control

As explained in Architecting an Apache Iceberg Lakehouse

Attribute-based access control is an authorization technique that makes permission decisions from attributes of users, resources, actions, or context.

Attribute-based access control (ABAC) makes authorization decisions from attributes such as a user’s department or location. In catalog architectures, it helps govern who can read, write, or administer particular tables and namespaces, alongside identity-provider integration and RBAC. section 7.2.2

Use ABAC as part of a layered governance design:

• Connect catalog identities and access contexts to enterprise providers such as OAuth, LDAP, SAML, or SSO. section 7.2.2
• Coordinate policy modeling with query-engine enforcement: row-level and column-level rules are typically applied at query time by engines such as Trino, Dremio, or Snowflake. section 4.3.3

Figure 7.6 Catalogs can have different levels of access control, allowing you to control who has access to which namespaces or tables.

Use the access-control diagram to compare how catalogs restrict access to namespaces and tables. section 7.2.2

How Architecting an Apache Iceberg Lakehouse covers it

How deep it goes

Defines attribute-based decisions and architectural placement, but stops short of specifying policy syntax or enforcement implementation.

Examples

Uses department and location attributes to illustrate authorization decisions for catalog-managed tables and namespaces.

What you can do after

Evaluate catalog requirements and determine how attribute-based policies should integrate with identity systems and query-engine enforcement.

How it connects

Connects catalogs with RBAC, identity providers, fine-grained access control, query engines, and data governance.

liveBookmanning.com

Read Architecting an Apache Iceberg Lakehouse on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Authorization in ActionAttribute-based access control (ABAC) is an authorization approach that makes decisions by evaluating attributes of subjects, resources, actions, and contextual conditions against rules.
• 

  liveBookmanning.com
  Software Security for DevelopersAn attribute-based access rule is a condition that grants or denies access by comparing relevant subject, resource, or environmental attributes.
• 

  liveBookmanning.com
  Secure APIsAttribute-based access control is an authorization model that determines permissions from attributes of users, resources, and contextual conditions.

Compare how 4 books explain attribute-based access control →

Related concepts

• role-based access controlcontrasts with · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
• attributeuses · An attribute is a named property, value, or piece of information associated with an entity, object, or program element.
• policyuses · A policy is a rule, strategy, or mapping that governs or determines decisions, actions, permissions, or behavior under specified conditions.
• relationship-based access controlcontrasts with · Relationship-based access control is an authorization technique that makes decisions from defined relationships among principals, resources, groups, and other entities.
• authorization modelkind of · An authorization model is a formal scheme that represents authority and determines whether subjects may perform actions on resources.
• authorizationkind of · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.

This explainer was generated by Manning's knowledge graph from the text of Architecting an Apache Iceberg Lakehouse. The section links point to the parts of the book it draws on.