Grant access to Grail
This tutorial will guide you through the process of setting up data access on Grail for your users. Access control to data in Grail happens on multiple levels: buckets, tables, records, and fields.
Who this is for
This tutorial is for Dynatrace account administrators who need to use default policies to grant users access to data stored in Grail.
What you'll learn
In this tutorial, you'll learn
- Which default policies are available for Grail access
- How to use those policies to grant access to monitoring data stored in Grail
Steps
We start by learning about available policies, and then we learn how to use those policies to grant access to monitoring data stored in Grail.
1. Default policies
Dynatrace comes with a set of built-in policies for data access. Their names all start with the storage
prefix. For example, take a look at the Storage Default Monitoring Read policy, which provides the following two permissions:
ALLOW storage:buckets:read WHERE storage:bucket-name STARTSWITH "default_;"ALLOW storage:events:read,storage:logs:read,storage:metrics:read,storage:entities:read,storage:bizevents:read,storage:spans:read;
This grants a user access to all tables and to all default buckets (they have the default_
prefix). Once custom buckets are created, users must get explicit access to them to access them.
Note: Built-in policies all provide unconditional table access. Once you start adopting record-level permissions, you'll need to replace the default policies with your own.
2. Grant access to data stored in Grail
Storage Default Monitoring Read
Administrators can use this permission to give users access to the tables and data stored in default buckets (default bucket names start with the default_
prefix). This policy will be adjusted automatically as new tables are added to Grail in the future.
Be aware that this policy only covers default buckets. Once custom buckets are added to Grail, administrators need to define additional permissions.
ALLOW storage:buckets:read WHERE storage:bucket-name startsWith “default_”;ALLOW storage:events:read, storage:logs:read, storage:metrics:read, storage:entities:read, storage:bizevents:read, storage:spans:read;
Storage Read per table
Each table includes a policy that combines table and bucket access called Storage <tablename>
Read. Administrators can use this policy to grant a user group access to a certain table and the assigned buckets.
ALLOW storage:buckets:read WHERE storage:table-name = “logs”;ALLOW storage:logs:read;
Storage All System Data Read
The Storage All System Data Read policy grants access to Dynatrace internal data such as auditing events and query execution events. Administrators can add this policy to those users who need access to this type of data.
ALLOW storage:buckets:read;ALLOW storage:system:read;ALLOW storage:events:read, storage:logs:read, storage:metrics:read, storage:entities:read, storage:bizevents:read,storage:spans:read;
Storage All Grail Data Read
The Storage All Grail Data Read policy grants unfiltered access to all data in Grail.
ALLOW storage:buckets:read;ALLOW storage:system:read;ALLOW storage:events:read, storage:logs:read, storage:metrics:read, storage:entities:read, storage:bizevents:read,storage:spans:read;
For full details, see bucket and table permissions for Grail documentation.