Policy to only allow user to configure service settings

Platform Open Q&A
, ,
1

I want to allow the users to modify settings (such as anomaly configuration) on a single service/entity level, without granting them the global settings on environment or cluster level for all services as global configuration.

I first tried the following:

ALLOW settings:objects:read, settings:objects:write
WHERE settings:scope startsWith 'SERVICE-';

The above policy statement does not seem to work as they do not see the setting option on the service/entity.

Then I tried the following:

ALLOW settings:objects:read, settings:objects:write
WHERE settings:schemaId = "builtin:anomaly-detection.services”;

The above policy statement does work on the service/entity level, but at the same time they also see the global environment settings option which I do not want.

How can I have a policy statement that allow the user to only modify the settings on service and entity level, but not globally? Thanks in advance!

2

Hi, for this you may have to append management zone with this. Please try

  • environment:management-zone - The name of a management zone. This condition is applicable to either: any settings object that is allowed on the scope of an entity that can be matched into a management zone or settings objects of the schemas builtin:alerting.maintenance-window, builtin:alerting.profile, builtin:anomaly-detection.metric-events, builtin:monitoring.slo and builtin:problem.notifications.
    operators: IN ,= ,startsWith
3

Lovely, it worked perfectly after implementing the management-zone. Thanks a lot!