Skip to content

Map Okera Access Permissions

To S3 Actions

The following table maps Okera access permissions to S3 actions.

Okera Access
Supported S3 Actions
Notes
ALL All of the actions below User can perform any of the supported S3 actions for objects/paths under the URI.
SELECT GetObject
HeadObject
CopyObject
PutObject
User can read files, folders, and buckets. Read access is provided for the source when a copy action is requested (CopyObject and putObject).

Note: Verify the correct privileges have been assigned to perform S3 actions for the URI. For example, if you intend to use a URI to create an external table, be sure that you have SELECT privileges, otherwise, the attempt to create the table will fail. See Access Levels.
INSERT CompleteMultipartUpload
UploadPart
AbortMultipartUpload
CopyObject
PutObject
User can write to files, folders, and buckets. Write access is also provided for the destination when a copy action is requested (CopyObject and putObject).
SHOW GetBucketLocation
HeadBucket
ListObjects
ListObjectsV2
User can perform metadata retrieval for files, folders, and buckets.
DELETE DeleteObject User can delete files.

To AWS CLI Commands

The following table maps AWS CLI commands to Okera permissions.

CLI Command
Okera Permissions
Equivalent S3 Actions
aws s3 sync pathA pathB SELECT pathA
INSERT pathB
SHOW pathB
CopyObject
CopyObject
HeadObject
aws s3 cp pathA pathB SELECT pathA
INSERT pathB
CopyObject
CopyObject
aws s3 mv pathA pathB SELECT pathA
INSERT pathB
SELECT pathA
DELETE pathA
HeadObject
CopyObject
CopyObject
DeleteObject
aws s3api copy-object pathA pathB SELECT copy-source
INSERT key
CopyObject
CopyObject
aws s3 is pathA SHOW pathA ListObjects
aws s3api create-multipart-upload INSERT key CreateMultipartUpload
aws s3api complete-multipart-upload INSERT key CompleteMultipartUpload
aws s3api abort-multipart-upload INSERT key AbortMultipartUpload
aws s3api head-bucket --bucket pathA SHOW bucket HeadBucket
aws s3api head-object --bucket bucketA --key pathA SHOW and SELECT pathA HeadObject
aws s3api list-buckets SHOW ListBuckets
aws s3api list-multipart-uploads SHOW ListMultipartUploads
aws s3api list-objects-v2 SHOW ListObjectsV2
aws s3api list-parts --key pathA INSERT pathA ListParts
aws s3api upload-part --key pathA INSERT pathA UploadPart
aws s3api upload-part-copy --copy-source pathA SELECT on pathA UploadPartCopy
aws s3api upload-part-copy --key pathA INSERT pathA UploadPartCopy
aws s3api delete-object DELETE DeleteObject

To Spark Actions

The following table maps Spark actions to Okera access permissions. Equivalent S3 actions re

Spark Actions
Okera Permissions
Equivalent S3 Actions
spark.write.* INSERT
SELECT
DELETE
SHOW
CopyObject
DeleteObject
GetObject
HeadObject
ListBucket
spark.read.* SHOW
SELECT
HeadObject
GetObject