IAM Policy statement (Service reference)

[RSarafaniuk]

As I saw in documentation, we can do policies with extensions, but I can't see from user account hub and can't set them up. I try to do such rule " ALLOW extensions:definitions:write WHERE extensions:extension-name = "Oracle Database"; " and have no result. Maybe someone tried such policies already and can make an example or give an advice?

[ChadTurner · Accepted solution]

You'll want to pull the Policy Schema's available in your environment. This can be done via the Environment API V2: 

Once you grab the desired Schema you can write it to allow or deny and provide that string into a Policy Schema which is then linked to a group that contains the users in which it will apply to. 

[AurelienGravier · Accepted solution]

Hello RSarafaniuk,

I have experimented the same issue for IAM with extensions and you are facing to a known issue on UI. 

The workaround is described here : 

https://community.dynatrace.com/t5/Dynatrace-tips/IAM-Policy-Read-and-write-permissions-to-extension...

Regards Aurélien.

[RSarafaniuk]

Hello @AurelienGravier and @ChadTurner,

Thank a lot for your support and given information. I will try to use it.