[NIFI-9679] Add Permissions for Accessing Environment Credentials

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.16.0
• Component/s: Core Framework, Extensions
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 11/Feb/22 21:17
• Updated: 02/Mar/22 17:31
• Resolved: 02/Mar/22 17:31

Description

Multiple extension components support authenticated access to various service providers using a variety of authentication strategies. Supporting libraries often provide fallback strategies that can read credentials from system properties, environment variables, or default file locations.

In some deployments, the fallback credentials may provide greater access to resources than would otherwise be supported through direct component configuration. Although a component may not be configured with explicit credentials, the component can access external service resources using fallback capabilities. In deployments with restricted access policies, the hosting server should be able to access these resources, but NiFi access should be limited.

Introducing a new Required Permission and annotating applicable components will support fine-grained control over NiFi component access. Applicable components include processors supporting access to Amazon Web Services, Google Cloud Platform, and Microsoft Azure.

Issue Links

• links to: GitHub Pull Request #5796