Ataccama ONE Agentic ONE Desktop ONE DQ&C ONE MDM ONE RDM ONE Runtime Server
latest (17.1.0) 17.0.0 16.3.x 16.2.0 16.1.0 16.0.0 15.4.0 15.3.0 15.2.0 15.1.x 14.5.x 13.9.x 13.8.x 13.7.x 13.6.x 13.5.0 13.4.x 13.3.x 13.2.x
Downloads

RDM Server Secured Environment

This article is applicable to Ataccama Cloud deployments only.

The RDM Server in Ataccama Cloud can run in a secured environment, a mode that limits what the plans and workflows in your RDM project can do on the server. This article describes the restrictions that apply in a secured environment and what they mean for your project.

What the secured environment is

The RDM Server is the ONE Runtime Server instance that runs the plans, workflows, schedules, and online services from your RDM project. In a secured environment, the RDM Server restricts what these plans and workflows can do on the server, so that a configuration mistake or a harmful configuration cannot affect the server itself or other components running alongside it.

The secured environment is optional and not enabled by default. To check whether it is enabled for your environment, or to request it, contact Ataccama Support.

The secured environment applies to the RDM Server only. It doesn’t affect the RDM web application and is not available in self-managed deployments.

What the RDM Server cannot do in a secured environment

In a secured environment, the following restrictions apply to the plans and workflows in your RDM project:

  • Workflow tasks that run commands on the operating system, such as Run Shell Script, Run Windows Command, or Run DQC Process, are rejected.

  • XSL transformations cannot read system properties or call Java functions.

  • The getParameterValue() function can read only a limited set of environment variables.

  • Files can be read and written only in allowed locations. See Where your plans and workflows can read and write files.

The secured environment does not restrict network access.

Where your plans and workflows can read and write files

In a secured environment, plans and workflows in your RDM project can read, write, and delete files only under /srv. This is where your RDM project is cloned from Git (/srv/conf/server/rdm) and where the RDM Server stores its data (/srv/data). Temporary directories on the server are also writable.

Elsewhere on the server, plans and workflows can list directories and check whether a file exists but cannot read or change file contents.

The Files folder of your project, for example, /srv/conf/server/rdm/Files/data, is under /srv, and the path variables of an RDM project deployed to Ataccama Cloud already point there. Keep the path variables as described in Edit path variables, and store any files your plans and workflows work with in the Files folder.

Access forbidden to file error

If a plan or workflow tries to access a file outside the allowed locations, the step fails and the server log contains the following error:

com.ataccama.dqc.commons.secenv.SecuredEnvironmentException: Access forbidden to file <path> (mode 0<n>)

To fix the error, move the file to the Files folder of your project. If the file has to stay where it is, contact Ataccama Support to have the location allowed (see Allowing additional file locations).

Custom JDBC drivers in a secured environment

In a secured environment, JDBC drivers are loaded only from the built-in driver directory of the RDM Server. A driver placed anywhere else does not load.

To use a bundled driver that is not registered by default, see Additional Database Drivers in RDM Server. If you need a driver that is not bundled with the RDM Server, contact Ataccama Support.

Allowing additional file locations

The allowed locations are defined in a file access policy that Ataccama manages for your environment.

If your project needs to access a location outside /srv, or a custom JDBC driver directory, contact Ataccama Support. Include the paths your plans and workflows need and the kind of access required (read, write, or delete).

How the secured environment is configured

Ataccama manages the configuration of your secured environment. The following details are for reference only:

  • The RDM Server Helm chart enables the secured environment through the securedEnvironment value, which is false by default. The chart starts the server with the SECURED_ENVIRONMENT environment variable and mounts the file access policy as /opt/ataccama/server.policy, referenced by the POLICY_FILE environment variable. In versions earlier than 17.0.0, the policy was referenced by DQC_POLICY_FILE, and DQC_SECURITY_MANAGER is no longer used.

  • The default policy is defined in the rdm-server-config-map ConfigMap and can be replaced through the serverPolicy value. Replacing it overrides the entire default policy, which then does not receive changes from later chart versions.

  • A custom policy has to start from the default policy as rendered in the ConfigMap of a running deployment, not from the chart source. The chart generates part of the default policy from a template, and templates are not expanded in the serverPolicy value.

  • For the policy format details, see Configuring custom policy rules in the ONE documentation.

Was this page useful?