IAM service reference
All supported values for each IAM service, permission, and condition are listed below. Use them to define access policies based on a fine-grained set of permissions and conditions that can be enforced per service.
- For an overview of Dynatrace IAM, see Manage policies and groups with Dynatrace IAM
- For some syntax help and examples, see IAM policy statement syntax and examples
- To list all REST API calls, see Dynatrace Account Management API 1.0
- To see examples of Dynatrace web UI and REST API configuration procedures, see IAM getting started
Global conditions
Policies with listed permissions can be further refined with global conditions.
app-engine
AppEngine
app-engine:apps:install
Grants permission to install and update apps
Conditions:
shared:app-id- The ID of the app.- operators:
IN,=,!=,startsWith,NOT IN,NOT startsWith
- operators:
app-engine:app-installer- The ID of the user that installed the app.- operators:
IN,=,!=,startsWith,NOT IN,NOT startsWith
- operators:
app-engine:apps:run
Grants permission to list and run apps and gives basic access to the Launcher
Conditions:
shared:app-id- The ID of the app.- operators:
IN,=,!=,startsWith,NOT IN,NOT startsWith
- operators:
app-engine:app-installer- The ID of the user that installed the app.- operators:
IN,=,!=,startsWith,NOT IN,NOT startsWith
- operators:
app-engine:apps:delete
Grants permission to uninstall apps
Conditions:
shared:app-id- The ID of the app.- operators:
IN,=,!=,startsWith,NOT IN,NOT startsWith
- operators:
app-engine:app-installer- The ID of the user that installed the app.- operators:
IN,=,!=,startsWith,NOT IN,NOT startsWith
- operators:
app-engine:functions:run
Grants permission to use the function-executor
app-engine:edge-connects:read
Grants permission to read EdgeConnects
app-engine:edge-connects:write
Grants permission to write EdgeConnects
app-engine:edge-connects:delete
Grants permission to delete EdgeConnects
app-settings
App Settings service
app-settings:objects:read
Grants permission to read app settings objects belonging to the schema
Conditions:
settings:schemaId- A string that uniquely identifies a single app settings schema. The identifier of a schema can be found in the info box of a settings screen. The condition will match if the object's schemaId property matches.- operators:
IN,=,!=,startsWith,NOT startsWith
- operators:
shared:app-id- A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
app-settings:objects:write
Grants permission to write settings objects belonging to the schema
Conditions:
settings:schemaId- A string that uniquely identifies a single settings schema. The identifier of a schema can be found in the info box of a settings screen. The condition will match if the object's schemaId property matches.- operators:
IN,=,!=,startsWith,NOT startsWith
- operators:
shared:app-id- A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
automation
Automation Server
automation:workflows:read
Grants permission to read workflows
automation:workflows:write
Grants permission to write workflows
automation:workflows:run
Grants permission to execute workflows
automation:workflows:admin
Grant admin permissions for workflows.
automation:rules:read
Grants permission to read scheduling rules
automation:rules:write
Grants permission to write scheduling rules
automation:calendars:read
Grants permission to read business calendars
automation:calendars:write
Grants permission to write business calendars
cloudautomation
Cloud Automation service
cloudautomation:resources:read
Grants permission to read resources stored in the Git repository
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:resources:write
Grants permission to write/edit resources stored in the Git repository
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:resources:delete
Grants permission to delete resources stored in the Git repository
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:metadata:read
Grants permission to read metadata of Cloud Automation
cloudautomation:events:read
Grants permission to read events in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:event- A string that uniquely identifies your Cloud Automation event type.- operators:
IN,=,!=
- operators:
cloudautomation:events:write
Grants permission to send events to Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:event- A string that uniquely identifies your Cloud Automation event type.- operators:
IN,=,!=
- operators:
cloudautomation:logs:read
Grants permission to read logs of Cloud Automation
cloudautomation:logs:write
Grants permission to write logs for Cloud Automation
cloudautomation:projects:read
Grants permission to read projects in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:projects:write
Grants permission to write/edit projects in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:projects:delete
Grants permission to delete projects in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stages:read
Grants permission to read stages in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:services:read
Grants permission to read services in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:services:write
Grants permission to write/edit services in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:services:delete
Grants permission to delete services in Cloud Automation
Conditions:
cloudautomation:project- A string that uniquely identifies your Cloud Automation project.- operators:
IN,=,!=
- operators:
cloudautomation:stage- A string that uniquely identifies your Cloud Automation stage.- operators:
IN,=,!=
- operators:
cloudautomation:service- A string that uniquely identifies your Cloud Automation service.- operators:
IN,=,!=
- operators:
cloudautomation:integrations:read
Grants permission to read integrations used in Cloud Automation
cloudautomation:integrations:write
Grants permission to write/edit integrations used in Cloud Automation
cloudautomation:integrations:delete
Grants permission to delete integrations used in Cloud Automation
cloudautomation:secrets:read
Grants permission to read secrets used in Cloud Automation
cloudautomation:secrets:write
Grants permission to write secrets used in Cloud Automation
cloudautomation:secrets:delete
Grants permission to delete secrets used in Cloud Automation
cloudautomation:instance:manage
Grants permission to manage a Cloud Automation instance
cloudautomation:statistics:read
Grants permission to read the usage statistics of a Cloud Automation instance
davis
Davis service
davis:analyzers:read
Grants permission to view Davis analyzers
davis:analyzers:execute
Grants permission to execute Davis analyzers
deployment
Deployment service
deployment:activegates.network-zones:write
Grants permission to write ActiveGate network zones
deployment:activegates.groups:write
Grants permission to write ActiveGate groups
deployment:oneagents.network-zones:write
Grants permission to write OneAgent network zones
deployment:oneagents.host-groups:write
Grants permission to write OneAgent host groups
deployment:oneagents.host-tags:write
Grants permission to write OneAgent host tags
deployment:oneagents.host-properties:write
Grants permission to write OneAgent host properties
document
Document service
document:documents:write
Grants permission to create and update documents of the document service
document:documents:read
Grants permission to read documents of the document service
document:documents:delete
Grants permission to delete documents of the document service
document:environment-shares:read
Grants permission to read environment shares of the document service
document:environment-shares:write
Grants permission to create and update environment shares of the document service
document:environment-shares:claim
Grants permission to claim environment shares of the document service
document:environment-shares:delete
Grants permission to delete environment shares of the document service
document:direct-shares:delete
Grants permission to delete direct shares of the document service
document:direct-shares:read
Grants permission to read direct shares of the document service
document:direct-shares:write
Grants permission to create and update direct shares of the document service
environment
Environment and management zone user permissions. See Migrate role-based permissions to Dynatrace IAM for more information.
environment:roles:viewer
Grants user the Access environment permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on the management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:manage-settings
Grants user the Change monitoring settings permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:agent-install
Grants user the Download/install OneAgent permission.
environment:roles:view-sensitive-request-data
Grants user the View sensitive request data permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:configure-request-capture-data
Grants user the Configure capture of sensitive data permission.
environment:roles:replay-sessions-without-masking
Grants user the Replay session data without masking permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:replay-sessions-with-masking
Grants user the Replay session data permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:manage-security-problems
Grants user the Manage security problems permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:view-security-problems
Grants user the View security problems permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
environment:roles:logviewer
Grants user the View logs permission.
Conditions:
environment:management-zone- A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.- operators:
IN,startsWith,NOT startsWith,=,!=
- operators:
extensions
Extensions service
extensions:definitions:read
Grants permission to read extension and environment configurations
Conditions:
extensions:extension-name- A string that uniquely identifies a single extension- operators:
IN,NOT IN,startsWith,NOT startsWith,!=,=
- operators:
extensions:definitions:write
Grants permission to write (update/create/delete) extension and environment configurations
Conditions:
extensions:extension-name- A string that uniquely identifies a single extension- operators:
IN,NOT IN,startsWith,NOT startsWith,!=,=
- operators:
extensions:configurations:read
Grants permission to read extension monitoring configurations
Conditions:
extensions:host- A string that uniquely identifies a single host for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:host-group- A string that uniquely identifies a single host group for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:ag-group- A string that uniquely identifies a single ActiveGate group for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:management-zone- A string that uniquely identifies a single management zone for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:configurations:write
Grants permission to write (update/create/delete) extension monitoring configurations
Conditions:
extensions:host- A string that uniquely identifies a single host for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:host-group- A string that uniquely identifies a single host group for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:ag-group- A string that uniquely identifies a single ActiveGate group for monitoring configuration assignment- operators:
IN,=
- operators:
extensions:management-zone- A string that uniquely identifies a single management zone for monitoring configuration assignment- operators:
IN,=
- operators:
hub
Representation of hub content in the context of a platform instance.
hub:catalog:read
Grants permission to read all public hub content.
identity-federation
Identity federation service
identity-federation:account-federation:read
Enables reading federations details and downloading federation Service Provider metadata.
identity-federation:account-federation:write
Enables creating, updating and deleting federations.
identity-federation:account:read
Enables reading the account card to review configuration of the account.
identity-federation:account:write
Enables the setting and clearing of the default federation for the account.
identity-federation:federated-domain:write
Enables the creation, updating, and deletion of federated domains in the account. Federated domains participate in federation discovery.
identity-federation:environment:read
Enables reading the environment card to review the configuration applied to environment.
identity-federation:environment:write
Enables configuring federation discovery on the environment level in the account.
platform-management
Platform Management
platform-management:tenants:write
Grants permission to create a new tenant or update an existing one
platform-management:tenants:read
Grants permission to retrieve a tenant or list tenants
settings
Settings service
settings:objects:read
Enables reading of settings objects belonging to the schema
Conditions:
settings:schemaId- A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the object's schemaId property matches.- operators:
IN,=,!=,startsWith,NOT startsWith
- operators:
shared:app-id- A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
settings:schemaGroup- A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema of the object has a schemaGroup property that matches.- operators:
IN,=
- operators:
settings:entity.hostGroup- The host group attribute of an entity for which a setting is stored. This is e.g. useful to grant access to settings scopes of all hosts which belong to the same host group.- operators:
IN,=,!=
- operators:
settings:scope- The exact scope identifier a setting object has or will have. This condition allows to grant access to the scope of e.g., an individual host. In this case the scope equals the entity identifier, e.g. HOST-48B8F52F33098830.- operators:
IN,=,!=
- operators:
environment:management-zone- The name of a management zone. This condition is applicable to either: settings objects of some schemas that are allowed in the environment scope or any settings object that is allowed on the scope of an entity that can be matched into a management zone.- operators:
IN,=,startsWith
- operators:
settings:objects:write
Enables writing of settings objects belonging to the schema
Conditions:
settings:schemaId- A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the object's schemaId property matches.- operators:
IN,=,!=,startsWith,NOT startsWith
- operators:
shared:app-id- A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
settings:schemaGroup- A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema of the object has a schemaGroup property that matches.- operators:
IN,=
- operators:
settings:entity.hostGroup- The host group attribute of an entity for which a setting is stored. This is e.g. useful to grant access to settings scopes of all hosts which belong to the same host group.- operators:
IN,=,!=
- operators:
settings:scope- The exact scope identifier a setting object has or will have. This condition allows to grant access to the scope of e.g., an individual host. In this case the scope equals the entity identifier, e.g. HOST-48B8F52F33098830.- operators:
IN,=,!=
- operators:
environment:management-zone- The name of a management zone. This condition is applicable to either: settings objects of some schemas that are allowed in the environment scope or any settings object that is allowed on the scope of an entity that can be matched into a management zone.- operators:
IN,=,startsWith
- operators:
settings:schemas:read
Enables reading settings schemas
Conditions:
settings:schemaId- A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema's schemaId property of the schema matches.- operators:
IN,=,!=,startsWith,NOT startsWith
- operators:
shared:app-id- A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
settings:schemaGroup- A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema's schemaId property of the schema matches.- operators:
IN,=
- operators:
state
Platform State Service
state:app-states:read
Grants permission to read app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state:app-states:write
Grants permission to write app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state:app-states:delete
Grants permission to delete app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state:user-app-states:read
Grants permission to read user-app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state:user-app-states:write
Grants permission to write user-app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state:user-app-states:delete
Grants permission to delete user-app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state-management
State Management - Clear app-states and user-app-states of specific apps.
state-management:app-states:delete
Grants permission to delete all app-states
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state-management:user-app-states:delete
Grants permission to delete user-app-states of the current user
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
state-management:user-app-states:delete-all
Grants permission to delete user-app-states of all users
Conditions:
shared:app-id- The ID of the app.- operators:
IN,NOT IN,startsWith,NOT startsWith,=,!=
- operators:
storage
Grail
storage:events:read
Grants permission to read records from the events-table
storage:metrics:read
Grants permission to read timeseries from the metrics-table
storage:logs:read
Grants permission to read records from the logs-table
storage:entities:read
Grants permission to read records from the entities-table
storage:bizevents:read
Grants permission to read records from the bizevents-table
storage:system:read
Grants permission to read records from all system tables (for example, dt.system.events).
storage:buckets:read
Grants permission to read records from Grail buckets. Required additionally to a table permission.
Conditions:
storage:table-name- Table name of the bucket that can be accessed.- operators:
=,IN,startsWith
- operators:
storage:bucket-name- Name of the bucket that can be accessed.- operators:
=,IN,startsWith
- operators:
storage:bucket-definitions:read
Grants permission to read bucket definitions from Grail
storage:bucket-definitions:write
Grants permission to write bucket definitions to Grail
storage:bucket-definitions:delete
Grants permission to delete bucket definitions from Grail
storage:bucket-definitions:truncate
Grants permission to delete all records from a bucket (not delete the bucket itself) in Grail.