...
Implementation of the SecureStore used by the program at runtime can be implemented by adapting calls to the underlying Hadoop KeyProvider, with an additional per key level permission check.
Hadoop without KMS
When KMS is not available, CDAP can provide an implementation of SecureStore with an architecture similar to KMS.
...