Policy global conditions

• Latest Dynatrace
• Reference
• 4-min read
• Updated on Oct 20, 2026

Global conditions (with the global: prefix) are conditions that can be applied to any policy statement because they are not service-specific. Service-specific conditions supported by each service are documented in IAM policy reference.

Environment and user conditions

global:environmentId

Global condition global:environmentId returns the environmentId for services within the environment's scope.

Example

This policy grants access only if the request targets the environment with the specified ID, regardless of where the policy is bound.

ALLOW environment:roles:viewer WHERE global:environmentId = "abc12345";

global:userId

Global condition global:userId returns the user ID of the user making the request. The user ID is a UUID.

Example

This policy grants access only to the user with the specified UUID.

ALLOW environment:roles:viewer WHERE global:userId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";

global:usernameDomain

Global condition global:usernameDomain returns the domain of the user.

Example

This policy grants access only to users in the specified domain.

ALLOW environment:roles:viewer WHERE global:usernameDomain = "example.com";

global:userGroup

Global condition global:userGroup returns a list of group IDs the user is a member of. The group ID is a UUID, not the group name.

Example

This policy provides users with access only if they are a member of the groups that are specified in the policy. Consider using this approach if you want to have a limited number of policies for managing access.

ALLOW environment:roles:viewer WHERE global:userGroup = "f47ac10b-58cc-4372-a567-0e02b2c3d479";

Date and time global conditions

The following are simple examples of how to work with time-based conditions in policy statements.

global:date

Global condition global:date is used as in the following example.

ALLOW service:resource:permission WHERE global:date > "2022-05-03Z" AND global:date < "2022-05-05Z";

In this example the policy grants access on the 4th of May 2022 in the UTC time zone.

Operators: <, >, =

See Date and time formats below for details on date and time formats.

global:date-time

Global condition global:date-time is used as in the following example.

ALLOW service:resource:permission WHERE global:date-time > "2022-05-03T05:00:00+01:00";

Operators: <, >

See Date and time formats below for details on date and time formats.

global:time-of-day

Global condition global:time-of-day is used as in the following example.

ALLOW service:resource:permission WHERE global:time-of-day > "09:00+01:00" AND global:time-of-day < "17:00+01:00";

Operators: <, >

See Date and time formats below for details on date and time formats.

global:week-day

Global condition global:week-day is used as in the following example.

ALLOW service:resource:permission WHERE global:week-day = "Monday";

Operators: =, !=, IN

See Date and time formats below for details on date and time formats.

Date and time formats

For global:date, global:date-time, and global:time-of-day, specify the value with a time zone according to ISO/WD 8601-1, where the character Z is used to designate that the date is in UTC.

ALLOW service:resource:permission WHERE global:week-day = "Monday";

ALLOW service:resource:permission WHERE global:date > "2022-05-03Z" AND global:date < "2022-05-05Z";

ALLOW service:resource:permission WHERE global:date-time > "2022-05-03T05:00:00+01:00";

ALLOW service:resource:permission WHERE global:time-of-day > "09:00+01:00" AND global:time-of-day < "17:00+01:00";