[Authz] Authz plugin does not work for queries using full path?

[nilan3]

I'm currently using hive metastore with authz plugin to enable authorization control using ranger. I can restrict users using ranger policies when queries are run against tables registered in Hive Metastore but users can still workaround the policies and query directly against the data path (we are using s3)

e.g. select * from parquet.s3a://bucket/path/table.parquet
https://kyuubi.readthedocs.io/en/master/security/authorization/spark/overview.html#:~:text=Spark%E2%80%99s%20configuration.%20For-,example,-%3A

I have explored options to defined URL based policies in ranger but this does not seem to take affect

[yaooqinn]

The feature - authz for URLs - has not been implemented yet.

Currently, we can only disable spark.sql.runSQLOnFiles system-wide and restrict end-users from modifying it

[nilan3]

thanks, I can take this approach and restrict users from querying files directly