topic Re: Control Tagging via IAM policy in Dynatrace Managed Q&A

Control Tagging via IAM policy

GilesDay — Wed, 02 Apr 2025 06:46:14 GMT

Has anyone looked into how to give a RO user access to create/edit tags? (ie Access Environment only with policy bound.

We have a very controlled environment with limited users who have change monitoring settings. We're looking to give out more permissions, starting with adding/updating tags to Synthetics. Ideally we could limit this to certain tags as well so that users don't mess up management zone/event management tags, but could change a MaintenanceWindow Tag. to On or Off.

Re: Control Tagging via IAM policy

jason_gs — Thu, 03 Apr 2025 19:33:06 GMT

you maybe able to to control access to Settings->Tags via a schema + policy, but not sub-group of Tags from the list within.

Re: Control Tagging via IAM policy

DanielS — Thu, 03 Apr 2025 22:28:58 GMT

Yes @GilesDay what you can do is to create a policy like the following one:

ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:tags.auto-tagging", "builtin:tags.manual-tagging", "builtin:alerting.maintenance-window");

as @jason_gs already told you, you can't control sub-groups of tags.