Data policy

Protecting access to data is a critical requirement for many enterprises. To ensure that your data is protected from unauthorized access, IBM® watsonx.data allows admin to enforce access controls for data. A user with admin privileges on the data can create access policies to define, extend, limit, and deny access, by using the data security solution that is provided by watsonx.data.

watsonx.data on IBM Software Hub

watsonx.data Developer edition

About this task

To maintain data security, you can create access policies for schemas, tables, and columns by permitting actions to individual users or group of users.

Ensure that you have Admin access to the catalog, storage, or service. For more information, see Infrastructure access.

Note: Ensure to add the users and user groups to the Software Hub platform and provide access to watsonx.data before you begin creating a policy. For more information, see Managing users.

Procedure

  1. Log in to watsonx.data console.
  2. From the navigation menu, select Access control.
  3. Go to the Policies tab and click Add policy. The Create access control policy page opens.
  4. In the Create access control policy page, provide the following details and click Next:
    Field Description
    Policy name Enter a name.
    Policy description (Optional) Give a brief description.
    Policy status after creation Set the status to activate the policy at the time of creation or later.
  5. In the Data objects page, select a resource from the drop-down list.
    You can select one of the following categories:
    Eligible catalogs
    1. Select a catalog. This lists all the schemas available in the catalog.
    2. Choose one, more than one, or all schemas.
      Note:
      • You can also proceed without choosing a schema, to allow the user to create their own schema.
      • If you choose a single schema, you can select one, more than one, or all tables.
      • If you choose more than one schema, you cannot select any table. The policy applies to all the tables associated with the selected schemas..
    3. Choose one, more than one, or all tables.
      Note:
      • You can also proceed without choosing a table to allow the user to create their own table.
      • If you choose a single table, you can select one, more than one, or all columns.
      • If you choose more than one table, you cannot select any columns. The policy applies to all columns of the tables.
    Storages
    1. Select a storage.
    2. Choose an object. Choose Regular Expression to enter the object path manually or Explore object path to search and select the object.
    Eligible services
    1. Select a service.
      Note: Currently, Milvus is the only service available. You can define policies to a Milvus service directly without selecting any databases. Select the service and proceed to step 7.
    2. Choose one, more than one, or all databases.
    3. Choose one, more than one, or all collections.
      Note:
      • If you choose a single database, you can select one, more than one, or all collections.
      • If you choose more than one database, you cannot select any collections. The policy applies to all collections in the selected databases.
  6. Click Next to add rules.
  7. In the Rules page:
    1. Click Add rule to go to the Add rule page.
    2. Select the rule type Allow or Deny.
    3. Select the actions on the data objects. The list of actions depend on the data object chosen in the earlier page. You can select one or more actions.
    4. In the Authorized users and groups section, click Add. The Add users and groups to rule page opens.
    5. Search and select one or more users or user groups to add to the rule. Ensure to add the users and user groups to the installation. For more information, see Managing user access.
    6. Click Add. The added users and user groups appear under the Authorized users and groups section.
    7. Click Add. The added rule appears in the Rules page.
    8. You can add more rules or click Review. The Summary page opens.
  8. In the Summary page:
    1. You can review the policy.
    2. Click Back to go to the previous page.
    3. Click Cancel to cancel the process.
    4. Or click Create to create the policy.
  9. To export the data policies, complete the following steps:
    1. In the Access control page, under the Policies tab, select the required (or all) policies and click the Export link.
      Note: You can export the details to a JSON file.
    2. The Export Users page opens. Specify the file name and click Export. The file gets downloaded to your machine.
  10. To import the resource policies, complete the following steps:
    Note: You can import JSON files only.
    1. In the Access control page, under the Policies tab, click Import link. The Import page opens.
    2. In the Upload File section, select the file with policies that you want to upload.
    3. Click Next. The Validate section appears.
      For Milvus, you must map the Milvus ID of imported policies to the corresponding Milvus ID of the instance where the policies are uploaded. To do that:
      • In the Validate page, the Mapping Milvus policies section list the Milvus policies that you uploaded.
      • For a policy, from the New instance list, choose the corresponding Milvus instance that needs to be mapped and click Validate.
    4. The file that you uploaded is validated and if any invalid data items are found, it gets displayed in the Invalid data items table with the error description.
    5. Click Next. The Summary section opens. Verify and click Add imported users.