RBAC Question for Hosts Access

[GregOReilly]

Hello,

We are working with a customer right now to onboard additional servers in Discovery mode to allow them to turn off the legacy tool.

The customer infrastructure manager only wants his team to be able to see the 1000+ servers, and is happy for any existing servers to be available to those existing users. His team are a service provider. They only need access to hosts (not logs, rum, spans, metrics and events only).

The infrastructure team also do not want everyone to see all servers.....just his team.

Is the right approach to TAG the new servers as INFRATEAMONLY=TRUE and then setup access for his team only see hosts with those tags?

Is there another way?

There are both classic and new apps we need to consider. Hosts Classic vs Infrastructure and Operations New.

Management Zones only work with Classic Apps.

Segments only work with new apps. Not Classic.

I cannot request a new tenant just for infrastructure monitoring because we have 100+ app servers in Full Stack. 

[AntonPineiro]

Hi,

Maybe this recent video about Dynatrace IAM might be helpful.

Best regards

[GregOReilly]

Thanks Anton, let me take a look.

[ChadTurner]

The link that @AntonPineiro shared will be a great source for planning out what you want to do. You also hit the nail on the head, With the Classic away using Management Zones and the Gen 3 way, using the Infrastructure and Operations App with segments will be your biggest hang up as Management Zones and Segments achieve the same overall function, however, the two are vastly different when designing and setting them up. 

[GregOReilly]

So we followed the video above. Added the "hosts" we want to control access too. We added to a dedicated management zone and then added a policy to allow "my new role" with access to the management zone.

This only works for Classic Hosts Applications. Not New Infrastructure or Clouds Apps.

What is the process to align this access? A segment? 

[GregOReilly]

To make things easy, we want to restrict access to hosts in Discovery Mode. One group for infrastructure teams will only be able to see those servers in Discovery.