Policy to only allow user to configure service settings

[Chen]

I want to allow the users to modify settings (such as anomaly configuration) on a single service/entity level, without granting them the global settings on environment or cluster level for all services as global configuration.

I first tried the following:

ALLOW settings:objects:read, settings:objects:write
WHERE settings:scope startsWith 'SERVICE-';

The above policy statement does not seem to work as they do not see the setting option on the service/entity.

Then I tried the following:

ALLOW settings:objects:read, settings:objects:write
WHERE settings:schemaId = "builtin:anomaly-detection.services”;

The above policy statement does work on the service/entity level, but at the same time they also see the global environment settings option which I do not want.

How can I have a policy statement that allow the user to only modify the settings on service and entity level, but not globally? Thanks in advance!

[RohitBisht · Accepted solution]

Hi, for this you may have to append management zone with this. Please try

https://docs.dynatrace.com/docs/shortlink/iam-policystatements#settings-objects-write
https://docs.dynatrace.com/docs/shortlink/iam-policy-boundaries#expressing-management-zones-inside-o...

• environment:management-zone - The name of a management zone. This condition is applicable to either: any settings object that is allowed on the scope of an entity that can be matched into a management zone or settings objects of the schemas builtin:alerting.maintenance-window, builtin:alerting.profile, builtin:anomaly-detection.metric-events, builtin:monitoring.slo and builtin:problem.notifications.
  operators: IN ,= ,startsWith

[Chen]

Lovely, it worked perfectly after implementing the management-zone. Thanks a lot!