Cloud Automation user permissions
To work with the Cloud Automation UI (bridge) and API, you need permissions as described below.
Define policies
Cloud Automation provides three default policies with view, approve, or admin permissions. They can be bound to groups, but we don't recommend that you customize them. Instead, create a new policy as described below.
ALLOW
cloudautomation:events:read,
cloudautomation:integrations:read,
cloudautomation:logs:read,
cloudautomation:metadata:read,
cloudautomation:projects:read,
cloudautomation:resources:read,
cloudautomation:secrets:read,
cloudautomation:services:read,
cloudautomation:stages:read;- An approver has viewer permissions and is allowed to send an event.
ALLOW
cloudautomation:events:write WHERE cloudautomation:event = "sh.keptn.event.approval.finished";- An admin has all permissions to manage a Cloud Automation instance.
ALLOW
cloudautomation:events:read,
cloudautomation:events:write,
cloudautomation:integrations:read,
cloudautomation:integrations:write,
cloudautomation:integrations:delete,
cloudautomation:logs:read,
cloudautomation:metadata:read,
cloudautomation:projects:read,
cloudautomation:projects:write,
cloudautomation:projects:delete,
cloudautomation:resources:read,
cloudautomation:resources:write,
cloudautomation:secrets:read,
cloudautomation:secrets:write,
cloudautomation:secrets:delete,
cloudautomation:services:read,
cloudautomation:services:write,
cloudautomation:services:delete,
cloudautomation:stages:read;To define a custom policy for a certain user group:
-
In the Dynatrace user menu
, go to Account settings. -
Select Accounts, then select your account tile.
-
Select Identity management > Policy management.
-
Select Add policy.
-
Enter a policy name and, optionally, a description of your policy. For example, to create an approver policy with a project restriction, you need to create two policies containing the following policy statements:
-
optional Depending on the policy statement you have defined, you can select different conditions as shown in the example of an approver with project restriction. See below for the conditions allowed for each policy statement.
-
Select Save.
Define a group
To define a group
- In the Dynatrace user menu , go to Account settings.
- Select Accounts, and then select your account tile.
- Select Identity management > Group management.
- Select Add group.
- Enter a group name and, optionally, a group description.
- Under Account permissions select Policies.
- Filter by the policy name for the default policy or the policy you created in Define policies, and then select Bind.
- Select Save.
Assign a user to a group
To assign a user to a group
- In the Dynatrace user menu , go to Account settings.
- Select Accounts, then select your account tile.
- Select Identity management > User management.
To add an existing user to the group
- Filter for the user and then select Edit.
- Scroll down to Assign groups to user and filter for the group name you created in Define groups.
- Select your group and then select Save.
To add a new user to the group
- Select Invite user.
- Enter the required details.
- Go to Assign groups to user and filter for the group name you created in Define groups.
- Select your group and then select Invite.
Authenticate the Cloud Automation user
After assigning a user to a user group that contains at least a viewer permission, the user can authenticate
-
On the Cloud Automation bridge
-
With the Cloud Automation CLI