Skip to main content

Policies

Policies control which assets users can access, and what operations they can carry out on those assets.

Retrieve policies​

From persona​

To retrieve a policy from a persona, you need to search for the policy by some characteristic:

Retrieve policies
AuthPolicy.select(client) // (1)
    .where(AuthPolicy.POLICY_CATEGORY.eq("persona"))
    .where(AuthPolicy.POLICY_RESOURCES.startsWith("entity:default/snowflake/1696324735")) // (2)
    .includeOnResults(AuthPolicy.NAME) // (3)
    .includeOnResults(AuthPolicy.ACCESS_CONTROL)
    .includeOnResults(AuthPolicy.POLICY_RESOURCES)
    .includeOnResults(AuthPolicy.CONNECTION_QUALIFIED_NAME)
    .includeOnResults(AuthPolicy.POLICY_TYPE)
    .includeOnResults(AuthPolicy.POLICY_SUB_CATEGORY)
    .includeOnRelations(IAccessControl.IS_ACCESS_CONTROL_ENABLED) // (4)
    .includeOnRelations(Asset.NAME)
    .stream() // (5)
    .filter(a -> a instanceof AuthPolicy)
    .forEach(p -> { // (6)
        AuthPolicy policy = (AuthPolicy) p;
    });
  1. Start by selecting policies, here using a FluentSearch-based approach. Because this operation may need to retrieve information from Atlan, you must provide it an AtlanClient through which to connect to the tenant.
  2. You can select the policy by whatever you like, in this example we're selecting based on the resources it controls (specifically in this example any assets in a particular snowflake connection).
  3. Include details about the policy itself in each search result, such as the access control mechanism the policy is defined within (the persona).
  4. Include all the attributes you want about the access control mechanism on the relations of the search results. Here we're including the name of and whether that persona is enabled or not.
  5. You can then directly stream the results of the search.
  6. For each result of the search (itself an AuthPolicy), you can then decide what to do with it.

From purpose​

Similarly, to retrieve a policy from a purpose you need to search for the policy by some characteristic:

Retrieve policies
String tagId = client.getAtlanTagCache().getIdForName("Issue"); // (1)
AuthPolicy.select(client) // (2)
    .where(AuthPolicy.POLICY_CATEGORY.eq("purpose"))
    .where(AuthPolicy.POLICY_RESOURCES.startsWith("tag:" + tagId)) // (3)
    .includeOnResults(AuthPolicy.NAME) // (4)
    .includeOnResults(AuthPolicy.ACCESS_CONTROL)
    .includeOnResults(AuthPolicy.POLICY_RESOURCES)
    .includeOnRelations(IAccessControl.IS_ACCESS_CONTROL_ENABLED) // (5)
    .includeOnRelations(Asset.NAME)
    .stream() // (6)
    .filter(a -> a instanceof AuthPolicy)
    .forEach(p -> { // (7)
        AuthPolicy policy = (AuthPolicy) p;
    });
  1. Since purposes work around Atlan tags, you may first want to retrieve the tag of interest (you need its internal ID rather than human-readable name).
  2. Start by selecting policies, here using a FluentSearch-based approach. Because this operation may need to retrieve information from Atlan, you must provide it an AtlanClient through which to connect to the tenant.
  3. You can select the policy by whatever you like, in this example we're selecting based on the resources it controls (specifically in this example the tag we retrieved earlier).
  4. Include details about the policy itself in each search result, such as the access control mechanism the policy is defined within (the purpose).
  5. Include all the attributes you want about the access control mechanism on the relations of the search results. Here we're including the name of and whether that purpose is enabled or not.
  6. You can then directly stream the results of the search.
  7. For each result of the search (itself an AuthPolicy), you can then decide what to do with it.

Update policies​

Different update approach from most assets

Unlike most assets, to update policies you should first retrieve the existing policy and then update it in its entirety. You can do this by either retrieving the entire policy asset by its GUID (if you know it), or by retrieving the policy using the instructions above under Retrieve policies. You must request at least the attributes defined in that section on each policy to be able to update the policy.

To update an existing policies, once you have retrieved it:

Update an existing policy
AuthPolicy policy = policy.toBuilder() // (1)
    .description("Revised explanation about what this policy does.") // (2)
    .build(); // (3)
AssetMutationResponse response = policy.save(client); // (4)
  1. Assuming you have already retrieved the policy you want to update (policy in this example), you can turn it into a mutable object using toBuilder().
  2. You can then apply any updates you want to the policy. These will either overwrite (where only a single value is allowed, such as description) or append to the existing values defined in the policy.
  3. Build up your changes.
  4. You can then save the revised policy back to Atlan. Because this operation will persist the structure in Atlan, you must provide it an AtlanClient through which to connect to the tenant.

Remove policies​

To remove a policy, you need only delete it as you would any other asset.

From persona​

To find the GUID of a specific policy in a persona:

Find a persona policy's GUID
List<Persona> list = Persona.findByName(client, "Data Assets"); // (1)
Persona persona = Persona.get(client, list.get(0).getGuid(), true); // (2)
for (AuthPolicy policy : persona.getPolicies()) has guid = {}",
             policy.getDisplayText(), // (4)
             policy.getGuid()); // (5)
}
  1. If you already have the persona or its GUID or qualifiedName, you can simply use it directly. This example reuses the search by name to obtain it. Because this operation will retrieve information from Atlan, you must provide it an AtlanClient through which to connect to the tenant.
  2. Once you have the minimal information about the persona, you may still need to retrieve the full persona itself (to make sure you have all of its policies and their inner details). Because this operation will retrieve information from Atlan, you must provide it an AtlanClient through which to connect to the tenant.
  3. You can then iterate through these policies...
  4. ...and check each policy's displayText for the name that's been given to the policy.
  5. ...and retrieve each policy's guid to be able to individually delete the appropriate policy.

From purpose​

To find the GUID of a specific policy in a purpose:

Find a purpose policy's GUID
List<Purpose> list = Purpose.findByName(client, "Known Issues"); // (1)
Purpose purpose = Purpose.get(client, list.get(0).getGuid(), true); // (2)
for (AuthPolicy policy : purpose.getPolicies()) has guid = {}",
             policy.getDisplayText(), // (4)
             policy.getGuid()); // (5)
}
  1. If you already have the purpose or its GUID or qualifiedName, you can simply use it directly. This example reuses the search by name to obtain it. Because this operation will retrieve information from Atlan, you must provide it an AtlanClient through which to connect to the tenant.
  2. Once you have the minimal information about the purpose, you may still need to retrieve the full purpose itself (to make sure you have all of its policies and their inner details). Because this operation will retrieve information from Atlan, you must provide it an AtlanClient through which to connect to the tenant.
  3. You can then iterate through these policies...
  4. ...and check each policy's displayText for the name that's been given to the policy.
  5. ...and retrieve each policy's guid to be able to individually delete the appropriate policy.
Was this page helpful?