---
name: AnalyticsEngine-security-model-serverless
title: Security model
description: ''
last-updated: 2021-04-19
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/AnalyticsEngine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:new_window: target="_blank"}
{:shortdesc: .shortdesc}
{:codeblock: .codeblock}
{:screen: .screen}
{:pre: .pre}
{:external: target="_blank" .external}

# Security model
{: #security-model-serverless}

IBM Analytics Engine serverless instances provide a security architecture that is designed to enable administrators and developers to create secure Spark clusters.

The following sections describe how the security model of IBM Analytics Engine serverlesss instances manages the access to and control of the secure instances.

## Controlling access to IBM Analytics Engine activities
{: #access-to-activities}

Access to IBM Analytics Engine serverless instances is controlled by IAM authentication and authorization. IAM is the Identity and Access Management service of IBM Cloud®. User authentication and access control happens through IAM when you log in with your IBMId. See how to [retrieve the IAM token](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-retrieve-iam-token-serverless&format=markdown).

As an administrator or creator of the service instance, you can grant or deny access to other users with whom you may want to share the service instance. All activities on the service instance life cycle management, like modifying the instance configuration, submitting and tracking Spark applications or customizing the instance with custom library sets are controlled through IAM authentication and authorization. See [Granting permissions to users](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-grant-permissions-serverless&format=markdown) to understand which operations are supported and what is the level of access required for each of those operations.

## Encrypting at Rest
{: #encrypting-at-rest}

IBM Cloud Object Storage is the recommended data store to store the data required for executing Spark jobs on the cluster. IBM Cloud Object Storage comes with default built-in encryption. See [Encrypting your data](https://cloud.ibm.com/docs/cloud-object-storage/basics?topic=cloud-object-storage-encryption&format=markdown#encryption).

In addition, or as an alternative to using IBM Cloud Object Storage storage encryption in analytic scenarios for large-scale data, you can use Parquet modular encryption, especially when fine-grained access control is important. See [Working with Parquet modular encryption](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-parquet-encryption-serverless&format=markdown).

## Encrypting endpoints
{: #encrypting-endpoints}

All service endpoints to the cluster are SSL encrypted (TLS 1.2 enabled). In addition, when you use IBM Analytics Engine with IBM Cloud Object Storage, the link between the Object Storage service instance and IBM Analytics Engine is encrypted.

## Isolation and network access
{: #isolation-network-access}

Each IBM Analytics Engine serverless instance gets is own isolated sandbox that is disconnected from other instances  from a network and security stand point.

Spark workloads deployed in an instance can:
- Communicate with other Spark workloads deployed in the same instance.
- Communicate with public internet
- Can connect with other IBM Cloud® services over private end points

Spark workloads in one IBM Analytics Engine instance cannot communicate with Spark workloads in another instance. See [Instance architecture](https://cloud.ibm.com/docs/AnalyticsEngine?topic=AnalyticsEngine-serverless-architecture-concepts&format=markdown#serverless-architecture) for more on instance isolation.

## Ensuring code security
{: #code-security}

You are advised to be cautious when applying libraries or package customization to your instance. You must use secure code from trusted sources only, so as not to compromise the overall security of the instances.

IBM recommends that you scan any source code, libraries, and packages you use before uploading them to your instance. While the use of non-trusted code will not impact others, it might impact you.

## Encrypting internal network data for Spark workload
{: #ency-spk-wrkld}

IBM Analytics Engine allows encrypting the internal communication between the Spark application components. To enable encryption in the private network, specify the configuration in any of the following two ways:

* At the time of provisioning an IBM Analytics Engine instance, specify the configuration under the default_config attribute.

    Example :

    ```bash

    "default_config": {
        "spark.ssl.enabled":"true"
    }
    ```
    {: codeblock}


* At the time of submitting a job, specify the options in the payload under `conf`.

    Example :

    ```bash

    {
     "conf": {
    "spark.ssl.enabled":"true"
     }
    }
    ```
    {: codeblock}