17 Jun 2024
07:15 PM
- last edited on
18 Jun 2024
07:58 AM
by
MaciejNeumann
Hi folks,
I am looking to lock down the ability to view logs from a certain host group with the following IAM policy:
"ALLOW storage:logs:read WHERE storage:dt.host_group.id = "Hostgroup2";"
In theory this should lock down my user to only be able to view logs for logs written by hosts in "Hostgroup2" HOWEVER when applying the policy my user is still able to see logs written by all host groups.
Is anyone able to advise? i have followed the syntax and conditions defined in the IAM service reference documentation.
17 Jun 2024 07:23 PM
You can see from the Policy review below the condition is set but does not take effect:
18 Jun 2024 09:59 AM - edited 18 Jun 2024 10:46 AM
Hi @JamesD09
have you checked with the "effective policies" tool whether there isn't another access right that would extend this policy and make this limitation ineffective?
You also have to check that no RBAC permission gives the user more rights over logs than you'd expect.