# Using IAM policies to only RUN, not EDIT notebooks

**URL:** <https://community.dynatrace.com/t/using-iam-policies-to-only-run-not-edit-notebooks/47214>\
**Category:** Dashboarding\
**Tags:** iam, notebooks\
**Created:** [August 20, 2024, 12:32pm UTC](https://community.dynatrace.com/t/using-iam-policies-to-only-run-not-edit-notebooks/47214 "2024-08-20T12:32:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marina\_pollehn](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/marina_pollehn/32/39120_2.png) [@marina\_pollehn](https://community.dynatrace.com/u/marina_pollehn)\
**Post date:** [August 20, 2024, 12:32pm UTC](https://community.dynatrace.com/t/using-iam-policies-to-only-run-not-edit-notebooks/47214/1 "2024-08-20T12:32:21Z")

</div>

Hi all, I want some users to be able to use my notebook (so also run it when they need to) but I do not want them to have edit rights to create own notebooks or remove something in my notebook. Is this possible with an IAM policy?

Preferably I would even like to limit these permissions to a specific notebook but I cannot find any allowed WHERE statements for&nbsp;document:documents:write or document:documents:read.

---

<div class="post-metadata">

**Author:** ![AntonPineiro](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/antonpineiro/32/49_2.png) [@AntonPineiro](https://community.dynatrace.com/u/AntonPineiro)\
**Post date:** [August 21, 2024, 11:01am UTC](https://community.dynatrace.com/t/using-iam-policies-to-only-run-not-edit-notebooks/47214/2 "2024-08-21T11:01:33Z")

</div>

Product idea has been raised → [https://community.dynatrace.com/t5/Product-ideas/Missing-the-IAM-document-documents-run-policy/idi-p/253759](https://community.dynatrace.com/post/253759)

---

<div class="post-metadata">

**Author:** ![marina\_pollehn](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/marina_pollehn/32/39120_2.png) [@marina\_pollehn](https://community.dynatrace.com/u/marina_pollehn)\
**Post date:** [August 21, 2024, 11:03am UTC](https://community.dynatrace.com/t/using-iam-policies-to-only-run-not-edit-notebooks/47214/3 "2024-08-21T11:03:46Z")

</div>

Thanks 🙂 Unfortunately I found out that it is not possible yet, so workarounds and product idea kudos are always welcome 😉

---

<div class="post-metadata">

**Author:** ![m3tomlins](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/m3tomlins/32/15924_2.png) [@m3tomlins](https://community.dynatrace.com/u/m3tomlins)\
**Post date:** [July 21, 2025, 7:59pm UTC](https://community.dynatrace.com/t/using-iam-policies-to-only-run-not-edit-notebooks/47214/4 "2025-07-21T19:59:58Z")

</div>

Hi Marina - I also have this same request, so I support your need here.

I made a comment on the product idea → [https://community.dynatrace.com/t5/Product-ideas/IAM-document-documents-run-policy/idc-p/281965/highlight/true#M53028](https://community.dynatrace.com/post/281965)