topic Why would I consider using Policy Templating? in Open Q&A

Why would I consider using Policy Templating?

GosiaMurawska — Tue, 28 Jan 2025 09:14:30 GMT

How does policy templating help in managing security boundaries within user groups?

Re: Why would I consider using Policy Templating?

Jon2 — Tue, 28 Jan 2025 09:15:33 GMT

Policy templating allows for the creation of reusable policies that implement parameterized values in their WHERE condition. An example policy that uses these bind parameters could be the following

ALLOW storage:logs:read WHERE storage:dt.security_context = "${bindParam:team}";

The actual values of the bind parameter ‘team’ are set uniquely with each group->policy binding.

In conclusion, if your user groups also represent security boundaries, then one way to pass that information into the bound policies is through policy templating. Doing so also reduces the footprint of your IAM policies.

Re: Why would I consider using Policy Templating?

Abidyaseen — Mon, 03 Feb 2025 07:02:15 GMT

The Dynatrace IAM policy templating guide explains how to create reusable, parameterized policies to simplify permission management. Instead of writing multiple policies for different contexts, you can define a single policy with a parameter reference. Parameters are assigned during policy binding via REST API. If parameters mismatch, a 400 error is returned. Updates are allowed only if the parameter set remains unchanged. Policies can also support lists as binding parameters. https://docs.dynatrace.com/docs/manage/identity-access-management/permission-management/manage-user-permissions-policies/advanced/iam-policy-templating?_gl=1*1x9rpg*_gcl_aw*R0NMLjE3MzQ0MjkwNDQuQ2p3S0NBaUEzNFM3QmhBdEVpd0FDWnp2NGN6ajZPNG96NGNLdmVUMVFNT041LVp3M2ZUR18xUU0zTGNpR3VXaEF5WmotNUFFU042LWRCb0NsUzRRQXZEX0J3RQ..*_gcl_dc*R0NMLjE3MzQ0MjkwNDQuQ2p3S0NBaUEzNFM3QmhBdEVpd0FDWnp2NGN6ajZPNG96NGNLdmVUMVFNT041LVp3M2ZUR18xUU0zTGNpR3VXaEF5WmotNUFFU042LWRCb0NsUzRRQXZEX0J3RQ..*_gcl_au*MTYyOTc2MjU5OC4xNzM1ODE1MTk5*_ga*MTQxNDI3MjUwOC4xNzEwODUzMzY5*_ga_1MEMV02JXV*MTczODU2NDM5Ni4zMzUuMS4xNzM4NTY1ODQzLjAuMC4w