Managed metastorage
The present application discloses a method, system, and computer system for providing access to information stored on system for data storage. The method includes receiving a data request from a user, determining data corresponding to the data request, determining whether the user has requisite permissions to access the data, and in response to determining that the user has requisite permissions to access the data: determining a manner by which to provide access to the data, wherein the data comprises a filtered subset of stored data, and generating a token based at least in part on the user and the manner by which access to the data is to be provided.
1. A system, comprising:
one or more processors; and
a memory, coupled with the one or more processors, the memory comprising stored instructions executable by the one or more processors, the instructions when executed causes the one or more processors to:
receive a data request from a user;
determine data corresponding to the data request;
determine whether the user has requisite permissions to access the data; and
in response to a determination that the user has requisite permissions to access the data:
determine, based on an identity of the user, a manner by which to provide access to the data, wherein the data comprises a filtered subset of stored data, wherein the determination of the manner by which to provide access to the data further comprises instructions to determine whether to provide the data via a secure cluster or to provide data by providing access to a location at which the data is stored, wherein the secure cluster is a set of connected nodes;
in response to a determination to provide data via a secure cluster, instantiating a secure cluster;
copying the filtered subset of stored data from the location at which the data is stored to the instantiated secure cluster, wherein the filtered subset of stored data copied to the instantiated secure cluster may only be accessible to the user; and
generate a token based at least in part on the user and the instantiated secure cluster.
2. The system of claim 1 , wherein the filtered subset of the stored data is stored in a new structure, a file, or table.
3. The system of claim 2 , wherein the token enables access to an entity stored on the secure cluster.
4. The system of claim 3 , wherein the filtered subset of the stored data is transferred from a storage system without selective access control.
5. The system of claim 1 , further comprising:
in response to determining to provide data by providing access to a location at which the data is stored, providing a path to the location at which the data is stored.
6. The system of claim 1 , wherein:
a storage system storing the stored data allows only access to the filtered subset of the stored data based on the token;
the storage system constitutes certain data responsive to the data request; and
in response to receiving a request in connection with the token, the storage system permits access associated with the request to only a table that has been constituted.
7. The system of claim 6 , wherein the certain data is constituted based on permissions associated with the user.
8. The system of claim 1 , wherein:
the stored data is stored on a system for data storage; and
user requests to access data comprised in the system for data storage are mediated by a metastore layer.
9. The system of claim 8 , wherein the metastore layer stores an index of information comprised in the stored data.
10. The system of claim 8 , wherein the metastore layer stores metadata associated with information comprised in the stored data.
11. The system of claim 8 , wherein the metastore layer stores permissions for one or more users with respect to information comprised in the stored data.
12. The system of claim 1 , wherein an extent of a permission that the token provides with respect to the stored data is defined based on the data request.
13. The system of claim 1 , wherein the token expires after a preset period of time, at a preset time, or in response to an action.
14. The system of claim 1 , wherein the one or more processors are further configured to provide to the user the token with which the user is to access data responsive to the data request.
15. A method, comprising:
receiving, by one or more processors, a data request from a user;
determining data corresponding to the data request;
determining whether the user has requisite permissions to access the data; and
in response to determining that the user has requisite permissions to access the data:
determining, based on an identity of the user, a manner by which to provide access to the data, wherein the data comprises a filtered subset of stored data, wherein determining the manner by which to provide access to the data further comprises determining whether to provide the data via a secure cluster or to provide data by providing access to a location at which the data is stored, wherein the secure cluster is a set of connected nodes;
in response to determining to provide data via a secure cluster, instantiating a secure cluster;
copying the filtered subset of stored data from the location at which the data is stored to the instantiated secure cluster, wherein the filtered subset of stored data copied to the instantiated secure cluster may only be accessible to the user; and
a token based at least in part on the user and the instantiated secure cluster.
16. The method of claim 15 , the filtered subset of the stored data is stored in a new structure, a file, or table.
17. The method of claim 15 , wherein the token enables access to an entity stored on the secure cluster.
18. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving, by one or more processors, a data request from a user;
determining data corresponding to the data request;
determining whether the user has requisite permissions to access the data; and
in response to determining that the user has requisite permissions to access the data:
determining, based on an identity of the user, a manner by which to provide access to the data, wherein the data comprises a filtered subset of stored data, wherein determining the manner by which to provide access to the data further comprises determining whether to provide the data via a secure cluster or to provide data by providing access to a location at which the data is stored, wherein the secure cluster is a set of connected nodes;
in response to determining to provide data via a secure cluster, instantiating a secure cluster;
copying the filtered subset of stored data from the location at which the data is stored to the instantiated secure cluster, wherein the filtered subset of stored data copied to the instantiated secure cluster may only be accessible to the user; and
generating a token based at least in part on the user and the instantiated secure cluster.
19. The computer program product embodied in the non-transitory computer readable medium of claim 18 , the filtered subset of the stored data is stored in a new structure, a file, or table.
20. The computer program product embodied in the non-transitory computer readable medium of claim 18 , wherein the token enables access to an entity stored on the secure cluster.