How to Configure a Read-Only Trino User for Hive Tables (File-Based Access Control)

The Use Case

You want to give analysts or BI tools (DBeaver, Superset, Tableau) read-only access to Hive tables in Trino — without modifying data or dropping partitions.

Architecture

User / BI Tool
      ↓
    Trino
      ↓
Hive Metastore (Kerberos)
      ↓
     HDFS

Access control operates at two layers:

Layer	Controls
Trino File-Based Access Control	SQL-level permissions (SELECT, INSERT, DROP…)
HDFS ACL	Filesystem read/write permissions

Step 1: Enable File-Based Access Control in Trino

Create /etc/trino/access-control.properties:

access-control.name=file
security.config-file=/etc/trino/rules.json

Step 2: Create the Rules File

Create /etc/trino/rules.json:

{
  "catalogs": [
    {
      "user": "analyst",
      "catalog": "hive",
      "allow": "read-only"
    },
    {
      "group": "bi_team",
      "catalog": "hive",
      "allow": "read-only"
    }
  ],
  "schemas": [
    {
      "user": "analyst",
      "schema": ".*",
      "owner": false
    }
  ],
  "tables": [
    {
      "user": "analyst",
      "privileges": ["SELECT"]
    },
    {
      "group": "bi_team",
      "privileges": ["SELECT"]
    }
  ]
}

Step 3: Set HDFS ACLs

Grant the Trino/Hive service user read access to the data:

# Allow analyst user to read warehouse data
hdfs dfs -setfacl -R -m user:analyst:r-x /warehouse/tablespace/

# Verify
hdfs dfs -getfacl /warehouse/tablespace/external/hive/mydb.db/

Step 4: Restart Trino

sudo systemctl restart trino
# or in CDP:
# Cloudera Manager → Trino → Actions → Restart

Step 5: Verify Access

-- Connect as analyst user
SELECT * FROM hive.mydb.mytable LIMIT 10;  -- should work

INSERT INTO hive.mydb.mytable VALUES (...);  -- should fail: Access Denied
DROP TABLE hive.mydb.mytable;               -- should fail: Access Denied

Important Notes

• File-based access control is static — reload requires a Trino restart or config file refresh
• For dynamic RBAC, use Apache Ranger with the Trino Ranger plugin
• Kerberos principals must map correctly to the Trino user identities
• Test with the exact BI tool connection string before rollout

Reference

Official Trino File System Access Control Docs