Permission fields

Latest Dynatrace
Reference
Published May 07, 2026

The following fields can be used in IAM policies that control read permissions of data stored in Grail, such as logs, metrics, spans, events and bizevents. See list of Grail read permissions.

Attribute	Type	Description	Examples
`aws.account.id`	string	resource stable Display name: `AWS account ID` The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: `permission` `primary-field`	`123456789012`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`dt.host_group.id`	string	resource stable Display name: `Host group ID` See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`. Tags: `permission` `primary-field`	`myHostGroup`
`dt.security_context`	string	resource stable Display name: `DT security context` The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: `permission`
`dt.space`	string	resource experimental Display name: `Space` The space associated with the record. Spaces enable granular scoping and delegation of monitoring responsibilities. Tags: `permission` `primary-field`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`INFRASTRUCTURE_EVENT`; `DAVIS_EVENT`; `BIZ_EVENT`; `RUM_EVENT`; `AUDIT_EVENT`; `BILLING_USAGE_EVENT`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`OneAgent`; `K8S`; `Davis`; `VMWare`; `GCP`; `AWS`; `LIMA_USAGE_STREAM`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`ESXI_HOST_MEMORY_SATURATION`; `PROCESS_RESTART`; `CPU_SATURATION`; `MEMORY_SATURATION`; `Automation Workflow`; `AppEngine Functions - Small`
`frontend.name`	string	stable Display name: `Frontend name` The frontend name determined at ingest. Tags: `permission`	`my_frontend`
`gcp.project.id`	string	resource stable Display name: `GCP project ID` Identifier of the GCP project associated with this resource. Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`
`log.source`	string	stable Display name: `Log source` The origin of the log record: a file path, URI, or equivalent stable reference to where the data was read from. Tags: `permission`	`/var/log/kube-apiserver/audit.log`; `s3://my-bucket/AWSLogs/123456789012/CloudTrail/`; `https://your-org.okta.com/api/v1/logs`
`metric.key`	string	stable Display name: `Metric key` The identifier of a metric, grouping numeric measurements that share the same measurement semantics (i.e. were measured "the same way".) Tags: `permission`	`dt.host.cpu.usage`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`

Permission fields

Latest Dynatrace

Reference

Published May 07, 2026

The following fields can be used in IAM policies that control read permissions of data stored in Grail, such as logs, metrics, spans, events and bizevents. See list of Grail read permissions.

Attribute	Type	Description	Examples
`aws.account.id`	string	resource stable Display name: `AWS account ID` The 12-digit number, such as 123456789012, that uniquely identifies an AWS account. Tags: `permission` `primary-field`	`123456789012`
`azure.resource.group`	string	resource stable Display name: `Azure resource group` A resource group is a container that holds related resources for an Azure solution. Tags: `permission` `primary-field`	`demo-backend-rg`
`azure.subscription`	string	resource stable Display name: `Azure subscription` An Azure subscription is a logical container used to provision resources in Azure. Tags: `permission` `primary-field`	`27e9b03f-04d2-2b69-b327-32f433f7ed21`
`dt.host_group.id`	string	resource stable Display name: `Host group ID` See Organize your environment using host groups. Note that host groups are identified by their name, not by the entity ID of the host group entity. For details on the entity ID, see `dt.entity.host_group`. Tags: `permission` `primary-field`	`myHostGroup`
`dt.security_context`	string	resource stable Display name: `DT security context` The security context is used in access permissions to limit the visibility. Learn more about the Dynatrace permission model Tags: `permission`
`dt.space`	string	resource experimental Display name: `Space` The space associated with the record. Spaces enable granular scoping and delegation of monitoring responsibilities. Tags: `permission` `primary-field`
`event.kind`	string	stable Display name: `Event kind` Gives high-level information about what kind of information the event contains without being specific about the contents of the event. It helps to determine the record type of a raw event. Tags: `permission`	`INFRASTRUCTURE_EVENT`; `DAVIS_EVENT`; `BIZ_EVENT`; `RUM_EVENT`; `AUDIT_EVENT`; `BILLING_USAGE_EVENT`
`event.provider`	string	stable Display name: `Event provider` Source of the event, for example, the name of the component or system that generated the event. Tags: `permission`	`OneAgent`; `K8S`; `Davis`; `VMWare`; `GCP`; `AWS`; `LIMA_USAGE_STREAM`
`event.type`	string	stable Display name: `Event type` The unique type identifier of a given event. Tags: `permission`	`ESXI_HOST_MEMORY_SATURATION`; `PROCESS_RESTART`; `CPU_SATURATION`; `MEMORY_SATURATION`; `Automation Workflow`; `AppEngine Functions - Small`
`frontend.name`	string	stable Display name: `Frontend name` The frontend name determined at ingest. Tags: `permission`	`my_frontend`
`gcp.project.id`	string	resource stable Display name: `GCP project ID` Identifier of the GCP project associated with this resource. Tags: `permission` `primary-field`	`dynatrace-gcp-extension`
`host.name`	string	resource experimental Display name: `Host name` The host name as determined on the data source (for instance, OneAgent, extensions or OpenTelemetry). Important: This is not the name of the host entity, which can be modified based on naming rules. Tags: `permission`	`ip-10-178-54-32.ec2.internal`
`k8s.cluster.name`	string	resource stable Display name: `Kubernetes cluster name` The user-defined name of the cluster in Dynatrace. Doesn't need to be unique or immutable. Tags: `permission` `primary-field`	`unguard-dev`; `acme-prod10`
`k8s.namespace.name`	string	resource stable Display name: `Kubernetes namespace name` The name of the namespace that the pod is running in. Tags: `permission` `primary-field`	`default`; `kube-system`
`log.source`	string	stable Display name: `Log source` The origin of the log record: a file path, URI, or equivalent stable reference to where the data was read from. Tags: `permission`	`/var/log/kube-apiserver/audit.log`; `s3://my-bucket/AWSLogs/123456789012/CloudTrail/`; `https://your-org.okta.com/api/v1/logs`
`metric.key`	string	stable Display name: `Metric key` The identifier of a metric, grouping numeric measurements that share the same measurement semantics (i.e. were measured "the same way".) Tags: `permission`	`dt.host.cpu.usage`
`type`	string	stable Display name: `Type` The entity type. UPPER_SNAKE_CASE string that represents the type of the entity. Tags: `permission`	`TYPE_A`