1. The IAM model #
Groups, policies, boundaries.
The concepts #
| Concept | Role |
|---|---|
| User | An authenticated person (SAML/OIDC SSO recommended) |
| Group | A set of users with the same needs (team, role) |
| Policy | A set of ALLOW rules on permissions (read problems, modify settings...) |
| Boundary | A condition that restricts a policy (by management zone, by entity tag) |
| Default policy | Policies predefined by Dynatrace (e.g. Standard User, Pro User, Admin User) |
2. Writing a policy #
Statement syntax.
Example #
// Politique « Lecteur - équipe paiement » (Account Management > Identity & access management > Policies)
ALLOW environment:roles:viewer;
ALLOW storage:logs:read, storage:metrics:read, storage:spans:read
WHERE storage:k8s.namespace.name = "paiement";
ALLOW settings:objects:read WHERE settings:schemaId = "builtin:alerting.profile";The WHERE part of a statement restricts the permission to a subset of data (for example a Kubernetes namespace). For Grail data, these conditions apply to storage fields.
Common mistake: Avoid giving write permissions (settings:objects:write) to broad groups: they allow changing the monitoring configuration of the whole organization.3. Organizing access #
A role-based approach.
Typical matrix #
| Group | Policies | Scope |
|---|---|---|
| Platform administrators | Admin User | Everything |
| Application teams | Standard User + log read | Boundary on their management zones |
| SRE / on-call | Pro User + problem management | Production |
| Auditors | Read-only | Everything, no write |
| Automation (CI/CD) | OAuth client token with limited scopes | One environment |
- Manage groups through SSO (SAML group mapping) so that arrivals/departures are automatic.
- Define groups and policies as code with Terraform (
dynatrace_iam_group,dynatrace_iam_policy). - Review access periodically (inactive accounts, obsolete rights).
4. Automating and auditing #
API and Terraform.
Terraform and API #
# Terraform : groupe + politique + liaison
resource "dynatrace_iam_policy" "lecteur_paiement" {
name = "Lecteur équipe paiement"
account = var.account_uuid
statement_query = <<-EOT
ALLOW environment:roles:viewer;
ALLOW storage:logs:read WHERE storage:k8s.namespace.name = "paiement";
EOT
}
resource "dynatrace_iam_group" "paiement" {
name = "equipe-paiement"
permissions {
permission { name = "tenant-viewer" type = "account" scope = var.account_uuid }
}
}
terraform init && terraform plan && terraform apply# Lister les groupes via l'API Account Management (jeton OAuth)
curl -s -H "Authorization: Bearer $DT_OAUTH_TOKEN" https://api.dynatrace.com/iam/v1/accounts/$ACCOUNT_UUID/groups | jq '.items[].name'
# Journal d'audit des changements de configuration
# Settings > Audit logs (ou API v2 /api/v2/auditlogs)Good practice: Apply the principle of least privilege: start from no access, add what is necessary and test with a test account before rolling out.
