topic IAM policy not taking effect in Open Q&A

IAM policy not taking effect

JamesD09 — Tue, 18 Jun 2024 06:58:47 GMT

Hi folks,

I am looking to lock down the ability to view logs from a certain host group with the following IAM policy:
"ALLOW storage:logs:read WHERE storage:dt.host_group.id = "Hostgroup2";"

In theory this should lock down my user to only be able to view logs for logs written by hosts in "Hostgroup2" HOWEVER when applying the policy my user is still able to see logs written by all host groups.

Is anyone able to advise? i have followed the syntax and conditions defined in the IAM service reference documentation.

Re: IAM policy not taking effect

JamesD09 — Mon, 17 Jun 2024 18:23:04 GMT

You can see from the Policy review below the condition is set but does not take effect:

Re: IAM policy not taking effect

GerardJ — Tue, 18 Jun 2024 09:46:14 GMT

Hi @JamesD09

have you checked with the "effective policies" tool whether there isn't another access right that would extend this policy and make this limitation ineffective?
You also have to check that no RBAC permission gives the user more rights over logs than you'd expect.