Generic Grail POLICY for more than 6K+ management zones

nicemukesh — Mon, 30 Sep 2024 05:55:11 GMT

We enabled GRAIL in our environment and need your help to create generic GRAIL policy using RBAC permission. Its not feasible to write 6k+ policies for each management zone. I want to write one to restrict user access to their respective MZ's.

Re: Generic Grail POLICY for more than 6K+ management zones

Maheedhar_T — Mon, 30 Sep 2024 12:16:59 GMT

Hi @nicemukesh ,
You can simply add ALLOW storage:logs:read for allowing read permissions to logs for the users. By default, if I have permission to only one management zone, I will be able to view logs only for that management zone. You need not configure any other permissions.

The control is essentially at the access level not at this policy level.

Regards,
Maheedhar Talluri.

topic Generic Grail POLICY for more than 6K+ management zones in Log Analytics

Generic Grail POLICY for more than 6K+ management zones

Re: Generic Grail POLICY for more than 6K+ management zones