Permission Restriction for High-Impact Settings

[eric_holloway]

Hello,

We are a small Dynatrace team working within a large organization, focusing on a self-serve model where "Power Users" manage application monitoring. Recently, we've encountered challenges with unintended changes affecting the organization, such as broad Maintenance Windows affecting alerting and issues with accidental OPL deletion.

We are seeking advice on what settings and applications we should restrict to admin-only access for settings we haven't thought of yet. While we have already secured the above examples and provided guidance on protocols, we would appreciate insights on additional settings or applications that should be exclusively managed by our team.

[DanielS · Accepted solution]

Hello @eric_holloway what you want is perfectly doable.

The way to do it through policies. I leave you the reference to start. https://docs.dynatrace.com/docs/shortlink/iam-policystatements and an overall guide https://docs.dynatrace.com/docs/shortlink/access-platform 

Please let me know if I can be of further assistance.

[eric_holloway]

Yeah, we are doing it through policies. My questions is "what settings can be high impact for an org and should be locked down to admins only?"

[DanielS · Accepted solution]

Well, this is a broad answer and may vary from organization to organization, but I can share my dedicated policy for power users to use in conjunction with the ALLOW environment:roles:viewer; role:

ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:synthetic.browser.name", "builtin:synthetic.browser.scheduling", "builtin:synthetic.http.name", "builtin:synthetic.http.scheduling", "builtin:synthetic.browser.assigned-applications", "builtin:synthetic.http.performance-thresholds", "builtin:synthetic.browser.kpms", "builtin:synthetic.http.assigned-applications", "builtin:synthetic.http.cookies", "builtin:synthetic.browser.performance-thresholds");
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN ("builtin:failure-detection.service.http-parameters", "builtin:failure-detection.service.general-parameters", "builtin:anomaly-detection.metric-events", "builtin:davis.anomaly-detectors", "builtin:metric.metadata", "builtin:settings.calculated-service-metrics", "builtin:user-action-custom-metrics" , "builtin:custom-metrics" , "builtin:tags.auto-tagging", "builtin:tags.manual-tagging", "builtin:alerting.maintenance-window", "builtin:alerting.profile", "builtin:problem.notifications", "builtin:monitoring.slo");
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN  ("builtin:rum.mobile.name", "builtin:rum.mobile.key-performance-metrics", "builtin:rum.mobile.request-errors", "builtin:rum.source-mappings", "builtin:rum.web.name", "builtin:rum.web.request-errors", "builtin:rum.web.custom-errors");
ALLOW settings:objects:read, settings:objects:write, settings:schemas:read WHERE settings:schemaId IN  ("builtin:settings.mutedrequests", "builtin:settings.subscriptions.service");

Hope it helps! At least is not a blank sheet to work on....

[DanielS]

I also add this blog post where you have a longer explanation, have in mind that this is the first one on a series.