Merge pull request #48849 from saveenr/patch-26

Update data-lake-store-access-control.md

Author: v-shils

articles/data-lake-store/data-lake-store-access-control.md

@@ -1,6 +1,6 @@
 ---
-title: Overview of access control in Data Lake Store | Microsoft Docs
-description: Understand how access control works in Azure Data Lake Store
+title: Overview of access control in Data Lake Storage Gen1 | Microsoft Docs
+description: Understand how access control works in Azure Data Lake Storage Gen1
 services: data-lake-store
 documentationcenter: ''
 author: nitinme
@@ -15,9 +15,9 @@ ms.date: 03/26/2018
 ms.author: nitinme
 
 ---
-# Access control in Azure Data Lake Store
+# Access control in Azure Data Lake Storage Gen1
 
-Azure Data Lake Store implements an access control model that derives from HDFS, which in turn derives from the POSIX access control model. This article summarizes the basics of the access control model for Data Lake Store. To learn more about the HDFS access control model, see [HDFS Permissions Guide](https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/HdfsPermissionsGuide.html).
+Azure Data Lake Storage Gen1 implements an access control model that derives from HDFS, which in turn derives from the POSIX access control model. This article summarizes the basics of the access control model for Data Lake Storage Gen1. To learn more about the HDFS access control model, see [HDFS Permissions Guide](https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/HdfsPermissionsGuide.html).
 
 ## Access control lists on files and folders
 
@@ -27,11 +27,11 @@ There are two kinds of access control lists (ACLs), **Access ACLs** and **Defaul
 
 * **Default ACLs**: A "template" of ACLs associated with a folder that determine the Access ACLs for any child items that are created under that folder. Files do not have Default ACLs.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-1.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-1.png)
 
 Both Access ACLs and Default ACLs have the same structure.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-2.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-2.png)
 
 
 
@@ -50,7 +50,7 @@ Every file and folder has distinct permissions for these identities:
 * Named groups
 * All other users
 
-The identities of users and groups are Azure Active Directory (Azure AD) identities. So unless otherwise noted, a "user," in the context of Data Lake Store, can either mean an Azure AD user or an Azure AD security group.
+The identities of users and groups are Azure Active Directory (Azure AD) identities. So unless otherwise noted, a "user," in the context of Data Lake Storage Gen1, can either mean an Azure AD user or an Azure AD security group.
 
 ## Permissions
 
@@ -60,7 +60,7 @@ The permissions on a filesystem object are **Read**, **Write**, and **Execute**,
 |------------|-------------|----------|
 | **Read (R)** | Can read the contents of a file | Requires **Read** and **Execute** to list the contents of the folder|
 | **Write (W)** | Can write or append to a file | Requires **Write** and **Execute** to create child items in a folder |
-| **Execute (X)** | Does not mean anything in the context of Data Lake Store | Required to traverse the child items of a folder |
+| **Execute (X)** | Does not mean anything in the context of Data Lake Storage Gen1 | Required to traverse the child items of a folder |
 
 ### Short forms for permissions
 
@@ -76,29 +76,29 @@ The permissions on a filesystem object are **Read**, **Write**, and **Execute**,
 
 ### Permissions do not inherit
 
-In the POSIX-style model that's used by Data Lake Store, permissions for an item are stored on the item itself. In other words, permissions for an item cannot be inherited from the parent items.
+In the POSIX-style model that's used by Data Lake Storage Gen1, permissions for an item are stored on the item itself. In other words, permissions for an item cannot be inherited from the parent items.
 
 ## Common scenarios related to permissions
 
-Following are some common scenarios to help you understand which permissions are needed to perform certain operations on a Data Lake Store account.
+Following are some common scenarios to help you understand which permissions are needed to perform certain operations on a Data Lake Storage Gen1 account.
 
 ### Permissions needed to read a file
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-3.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-3.png)
 
 * For the file to be read, the caller needs **Read** permissions.
 * For all the folders in the folder structure that contain the file, the caller needs **Execute** permissions.
 
 ### Permissions needed to append to a file
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-4.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-4.png)
 
 * For the file to be appended to, the caller needs **Write** permissions.
 * For all the folders that contain the file, the caller needs **Execute** permissions.
 
 ### Permissions needed to delete a file
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-5.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-5.png)
 
 * For the parent folder, the caller needs **Write + Execute** permissions.
 * For all the other folders in the file’s path, the caller needs **Execute** permissions.
@@ -112,24 +112,24 @@ Following are some common scenarios to help you understand which permissions are
 
 ### Permissions needed to enumerate a folder
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-6.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-6.png)
 
 * For the folder to enumerate, the caller needs **Read + Execute** permissions.
 * For all the ancestor folders, the caller needs **Execute** permissions.
 
 ## Viewing permissions in the Azure portal
 
-From the **Data Explorer** blade of the Data Lake Store account, click **Access** to see the ACLs for the file or folder being viewed in the Data Explorer. Click **Access** to see the ACLs for the **catalog** folder under the **mydatastore** account.
+From the **Data Explorer** blade of the Data Lake Storage Gen1 account, click **Access** to see the ACLs for the file or folder being viewed in the Data Explorer. Click **Access** to see the ACLs for the **catalog** folder under the **mydatastore** account.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-1.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-1.png)
 
 On this blade, the top section shows the owners permissions. (In the screenshot, the owning user is Bob.) Following that, the assigned Access ACLs are shown. 
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-simple-view.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-simple-view.png)
 
 Click **Advanced View** to see the more advanced view, where the Default ACLs, mask, and a description of super-users are shown.  This blade also provides a way to recursively set Access and Default ACLs for child files and folders based on the permissions of the current folder.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-advance-view.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-advance-view.png)
 
 ## The super-user
 
@@ -139,13 +139,13 @@ A super-user has the most rights of all the users in the Data Lake Store. A supe
 * Can change the permissions on any file or folder.
 * Can change the owning user or owning group of any file or folder.
 
-In Azure, a Data Lake Store account has several Azure roles, including:
+In Azure, a Data Lake Storage Gen1 account has several Azure roles, including:
 
 * Owners
 * Contributors
 * Readers
 
-Everyone in the **Owners** role for a Data Lake Store account is automatically a super-user for that account. To learn more, see [Role-based access control](../role-based-access-control/role-assignments-portal.md).
+Everyone in the **Owners** role for a Data Lake Storage Gen1 account is automatically a super-user for that account. To learn more, see [Role-based access control](../role-based-access-control/role-assignments-portal.md).
 If you want to create a custom role-based-access control (RBAC) role that has super-user permissions, it needs to have the following permissions:
 - Microsoft.DataLakeStore/accounts/Superuser/action
 - Microsoft.Authorization/roleAssignments/write
@@ -167,9 +167,9 @@ The user who created the item is automatically the owning user of the item. An o
 
 In the POSIX ACLs, every user is associated with a "primary group." For example, user "alice" might belong to the "finance" group. Alice might also belong to multiple groups, but one group is always designated as her primary group. In POSIX, when Alice creates a file, the owning group of that file is set to her primary group, which in this case is "finance."
 
-When a new filesystem item is created, Data Lake Store assigns a value to the owning group.
+When a new filesystem item is created, Data Lake Storage Gen1 assigns a value to the owning group.
 
-* **Case 1**: The root folder "/". This folder is created when a Data Lake Store account is created. In this case, the owning group is set to the user who created the account.
+* **Case 1**: The root folder "/". This folder is created when a Data Lake Storage Gen1 account is created. In this case, the owning group is set to the user who created the account.
 * **Case 2** (Every other case): When a new item is created, the owning group is copied from the parent folder.
 
 The owning group otherwise behaves similarly to assigned permissions for other users/groups.
@@ -183,9 +183,9 @@ The owning group can be changed by:
 
 ## Access check algorithm
 
-The following illustration represents the access check algorithm for Data Lake Store accounts.
+The following illustration represents the access check algorithm for Data Lake Storage Gen1 accounts.
 
-![Data Lake Store ACLs algorithm](./media/data-lake-store-access-control/data-lake-store-acls-algorithm.png)
+![Data Lake Storage Gen1 ACLs algorithm](./media/data-lake-store-access-control/data-lake-store-acls-algorithm.png)
 
 
 ## The mask and "effective permissions"
@@ -198,18 +198,18 @@ The **mask** is an RWX value that is used to limit access for **named users**, t
 
 Let's look at some examples. In the following example, the mask is set to **RWX**, which means that the mask does not remove any permissions. The effective permissions for the named user, owning group, and named group are not altered during the access check.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-mask-1.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-mask-1.png)
 
 In the following example, the mask is set to **R-X**. This means that it **turns off the Write permissions** for **named user**, **owning group**, and **named group** at the time of access check.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-mask-2.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-mask-2.png)
 
 For reference, here is where the mask for a file or folder appears in the Azure portal.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-mask-view.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-show-acls-mask-view.png)
 
 > [!NOTE]
-> For a new Data Lake Store account, the mask for the Access ACL of the root folder ("/") defaults to RWX.
+> For a new Data Lake Storage Gen1 account, the mask for the Access ACL of the root folder ("/") defaults to RWX.
 >
 >
 
@@ -224,7 +224,7 @@ When a new file or folder is created under an existing folder, the Default ACL o
 
 When a child file or folder is created, the parent's Default ACL is copied as the Access ACL of the child file or folder. Also, if **other** user has RWX permissions in the parent's default ACL, it is removed from the child item's Access ACL.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-child-items-1.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-child-items-1.png)
 
 In most scenarios, the previous information is all you need to know about how a child item’s Access ACL is determined. However, if you are familiar with POSIX systems and want to understand in-depth how this transformation is achieved, see the section [Umask’s role in creating the Access ACL for new files and folders](#umasks-role-in-creating-the-access-acl-for-new-files-and-folders) later in this article.
 
@@ -233,17 +233,17 @@ In most scenarios, the previous information is all you need to know about how a
 
 When a child folder is created under a parent folder, the parent folder's Default ACL is copied over as is to the child folder's Default ACL.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-child-items-2.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-child-items-2.png)
 
-## Advanced topics for understanding ACLs in Data Lake Store
+## Advanced topics for understanding ACLs in Data Lake Storage Gen1
 
-Following are some advanced topics to help you understand how ACLs are determined for Data Lake Store files or folders.
+Following are some advanced topics to help you understand how ACLs are determined for Data Lake Storage Gen1 files or folders.
 
 ### Umask’s role in creating the Access ACL for new files and folders
 
 In a POSIX-compliant system, the general concept is that umask is a 9-bit value on the parent folder that's used to transform the permission for **owning user**, **owning group**, and **other** on the Access ACL of a new child file or folder. The bits of a umask identify which bits to turn off in the child item’s Access ACL. Thus it is used to selectively prevent the propagation of permissions for **owning user**, **owning group**, and **other**.
 
-In an HDFS system, the umask is typically a sitewide configuration option that is controlled by administrators. Data Lake Store uses an **account-wide umask** that cannot be changed. The following table shows the unmask for Data Lake Store.
+In an HDFS system, the umask is typically a sitewide configuration option that is controlled by administrators. Data Lake Storage Gen1 uses an **account-wide umask** that cannot be changed. The following table shows the unmask for Data Lake Storage Gen1.
 
 | User group  | Setting | Effect on new child item's Access ACL |
 |------------ |---------|---------------------------------------|
@@ -253,13 +253,13 @@ In an HDFS system, the umask is typically a sitewide configuration option that i
 
 The following illustration shows this umask in action. The net effect is to remove **Read + Write + Execute** for **other** user. Because the umask did not specify bits for **owning user** and **owning group**, those permissions are not transformed.
 
-![Data Lake Store ACLs](./media/data-lake-store-access-control/data-lake-store-acls-umask.png)
+![Data Lake Storage Gen1 ACLs](./media/data-lake-store-access-control/data-lake-store-acls-umask.png)
 
 ### The sticky bit
 
-The sticky bit is a more advanced feature of a POSIX filesystem. In the context of Data Lake Store, it is unlikely that the sticky bit will be needed.
+The sticky bit is a more advanced feature of a POSIX filesystem. In the context of Data Lake Storage Gen1, it is unlikely that the sticky bit will be needed.
 
-The following table shows how the sticky bit works in Data Lake Store.
+The following table shows how the sticky bit works in Data Lake Storage Gen1.
 
 | User group         | File    | Folder |
 |--------------------|---------|-------------------------|
@@ -268,13 +268,13 @@ The following table shows how the sticky bit works in Data Lake Store.
 
 The sticky bit is not shown in the Azure portal.
 
-## Common questions about ACLs in Data Lake Store
+## Common questions about ACLs in Data Lake Storage Gen1
 
-Here are some questions that come up often about ACLs in Data Lake Store.
+Here are some questions that come up often about ACLs in Data Lake Storage Gen1.
 
 ### Do I have to enable support for ACLs?
 
-No. Access control via ACLs is always on for a Data Lake Store account.
+No. Access control via ACLs is always on for a Data Lake Storage Gen1 account.
 
 ### Which permissions are required to recursively delete a folder and its contents?
 
@@ -306,15 +306,15 @@ Entries in the ACLs are stored as GUIDs that correspond to users in Azure AD. Th
 
 A GUID is shown when the user doesn't exist in Azure AD anymore. Usually this happens when the user has left the company or if their account has been deleted in Azure AD.
 
-### Does Data Lake Store support inheritance of ACLs?
+### Does Data Lake Storage Gen1 support inheritance of ACLs?
 
 No, but Default ACLs can be used to set ACLs for child files and folder newly created under the parent folder.  
 
 ### What is the difference between mask and umask?
 
 | mask | umask|
 |------|------|
-| The **mask** property is available on every file and folder. | The **umask** is a property of the Data Lake Store account. So there is only a single umask in the Data Lake Store.    |
+| The **mask** property is available on every file and folder. | The **umask** is a property of the Data Lake Storage Gen1 account. So there is only a single umask in the Data Lake Storage Gen1.    |
 | The mask property on a file or folder can be altered by the owning user or owning group of a file or a super-user. | The umask property cannot be modified by any user, even a super-user. It is an unchangeable, constant value.|
 | The mask property is used during the access check algorithm at runtime to determine whether a user has the right to perform on operation on a file or folder. The role of the mask is to create "effective permissions" at the time of access check. | The umask is not used during access check at all. The umask is used to determine the Access ACL of new child items of a folder. |
 | The mask is a 3-bit RWX value that applies to named user, owning group, and named group at the time of access check.| The umask is a 9-bit value that applies to the owning user, owning group, and **other** of a new child.|
@@ -339,4 +339,4 @@ No, but Default ACLs can be used to set ACLs for child files and folder newly cr
 
 ## See also
 
-* [Overview of Azure Data Lake Store](data-lake-store-overview.md)
+* [Overview of Azure Data Lake Storage Gen1](data-lake-store-overview.md)