The following is a complete reference of IAM permissions and corresponding conditions applicable to Dynatrace services. Refer to it when you need to define access policies based on a fine-grained set of permissions and conditions that can be enforced per service.
Cloud Automation service
Grants permission to read resources stored in the Git repository
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=Grants permission to write/edit resources stored in the Git repository
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=Grants permission to delete resources stored in the Git repository
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=Grants permission to read metadata of Cloud Automation
Grants permission to read events in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=cloudautomation:event - A string that uniquely identifies your Cloud Automation event type.IN ,= ,!=Grants permission to send events to Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=cloudautomation:event - A string that uniquely identifies your Cloud Automation event type.IN ,= ,!=Grants permission to read logs of Cloud Automation
Grants permission to write logs for Cloud Automation
Grants permission to read projects in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=Grants permission to write/edit projects in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=Grants permission to delete projects in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=Grants permission to read stages in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=Grants permission to read services in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=Grants permission to write/edit services in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=Grants permission to delete services in Cloud Automation
cloudautomation:project - A string that uniquely identifies your Cloud Automation project.IN ,= ,!=cloudautomation:stage - A string that uniquely identifies your Cloud Automation stage.IN ,= ,!=cloudautomation:service - A string that uniquely identifies your Cloud Automation service.IN ,= ,!=Grants permission to read integrations used in Cloud Automation
Grants permission to write/edit integrations used in Cloud Automation
Grants permission to delete integrations used in Cloud Automation
Grants permission to read secrets used in Cloud Automation
Grants permission to write secrets used in Cloud Automation
Grants permission to delete secrets used in Cloud Automation
Grants permission to manage a Cloud Automation instance
Grants permission to read the usage statistics of a Cloud Automation instance
Davis service
Grants permission to view Davis analyzers
Grants permission to execute Davis analyzers
Deployment service
Grants permission to write ActiveGate network zones
Grants permission to write ActiveGate groups
Grants permission to write OneAgent network zones
Grants permission to write OneAgent host groups
Grants permission to write OneAgent host tags
Grants permission to write OneAgent host properties
Grants permission to write OneAgent communication settings
API for sending emails
Grants permission to send emails from @apps.dynatrace.com with send email API
Environment and management zone user permissions. See Migrate role-based permissions to Dynatrace IAM for more information.
Role IAM permissions work the same way as classic roles do, which means that the environment:roles:viewer permission is a part of any other role permission. For example, a policy granting environment:roles:manage-settings permission also allows a user to access the web UI.
Grants user the Access environment permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on the management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the Change monitoring settings permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the Download/install OneAgent permission. Users who have this permission assigned are also able to view monitoring data for all management zones.
Grants user the View sensitive request data permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the Configure capture of sensitive data permission. Users who have this permission assigned are also able to view monitoring data for all management zones.
Grants user the Replay session data without masking permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the Replay session data permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the Manage security problems permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the View security problems permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Grants user the View logs permission.
environment:management-zone - A string that uniquely identifies a management zone. Applies the permission on management zone level for the specified management zone.IN ,startsWith ,NOT startsWith ,= ,!=Extensions service
Grants permission to read extension and environment configurations
extensions:extension-name - A string that uniquely identifies a single extensionIN ,NOT IN ,startsWith ,NOT startsWith ,!= ,=Grants permission to write (update/create/delete) extension and environment configurations
extensions:extension-name - A string that uniquely identifies a single extensionIN ,NOT IN ,startsWith ,NOT startsWith ,!= ,=Grants permission to read extension monitoring configurations
extensions:host - A string that uniquely identifies a single host for monitoring configuration assignmentIN ,=extensions:host-group - A string that uniquely identifies a single host group for monitoring configuration assignmentIN ,=extensions:ag-group - A string that uniquely identifies a single ActiveGate group for monitoring configuration assignmentIN ,=extensions:management-zone - A string that uniquely identifies a single management zone for monitoring configuration assignmentIN ,=extensions:extension-name - A string that uniquely identifies a single extensionIN ,NOT IN ,startsWith ,NOT startsWith ,!= ,=Grants permission to write (update/create/delete) extension monitoring configurations
extensions:host - A string that uniquely identifies a single host for monitoring configuration assignmentIN ,=extensions:host-group - A string that uniquely identifies a single host group for monitoring configuration assignmentIN ,=extensions:ag-group - A string that uniquely identifies a single ActiveGate group for monitoring configuration assignmentIN ,=extensions:management-zone - A string that uniquely identifies a single management zone for monitoring configuration assignmentIN ,=extensions:extension-name - A string that uniquely identifies a single extensionIN ,NOT IN ,startsWith ,NOT startsWith ,!= ,=Grants permission to execute actions for extension
extensions:host - A string that uniquely identifies a single host for monitoring configuration assignmentIN ,=extensions:host-group - A string that uniquely identifies a single host group for monitoring configuration assignmentIN ,=extensions:ag-group - A string that uniquely identifies a single ActiveGate group for monitoring configuration assignmentIN ,=extensions:management-zone - A string that uniquely identifies a single management zone for monitoring configuration assignmentIN ,=extensions:extension-name - A string that uniquely identifies a single extensionIN ,NOT IN ,startsWith ,NOT startsWith ,!= ,=Geolocation Service
Grants permission to lookup geolocations for IP adresses.
Hub provides catalog content, such as Dynatrace Apps, Extensions, and Technologies, in the context of the environment.
Grants permission to read the hub catalog content.
Hyperscaler authentication service
Grants permission to authenticate against AWS.
Identity and Access Management Framework.
Grants permission to use all or specified service users
iam:service-user-email - Service users emailsIN ,=Grants permission to read bindings
iam:policyUuid - Policy uuid in the URI.= ,INiam:levelType - Level type in the URI.= ,INiam:boundGroup - Group uuid in the URI.= ,INGrants permission to create bindings
iam:policyUuid - Policy uuid in the URI.= ,INiam:levelType - Level type in the URI.= ,INiam:boundGroup - Group uuid in the URI.= ,INGrants permission to read policies
Grants permission to create policies
Grants permission to read boundaries
Grants permission to create boundaries
Grants permission to read effective permissions
iam-param:entity-type - Entity type in the query parameters. Allowed values: group, user.=iam-param:entity-id - Entity id of given entity-type in the query parameters.= ,INGrants permission to read limits
Identity federation service
Enables reading federations details and downloading federation Service Provider metadata.
Enables creating, updating and deleting federations.
Enables reading the account card to review configuration of the account.
Enables the setting and clearing of the default federation for the account.
Enables the creation, updating, and deletion of federated domains in the account. Federated domains participate in federation discovery.
Enables reading the environment card to review the configuration applied to environment.
Enables configuring federation discovery on the environment level in the account.
API for sending notifications
Grants permission to read self notifications.
Grants permission to write self notifications.
Settings service
Enables reading of settings objects belonging to the schema
settings:schemaId - A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the object's schemaId property matches.IN ,= ,!= ,startsWith ,NOT startsWithshared:app-id - A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.IN ,NOT IN ,startsWith ,NOT startsWith ,= ,!=settings:schemaGroup - A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema of the object has a schemaGroup property that matches.IN ,=settings:entity.hostGroup - The host group attribute of an entity for which a setting is stored. This is e.g. useful to grant access to settings scopes of all hosts which belong to the same host group.IN ,= ,!=settings:scope - The exact scope identifier a setting object has or will have. This condition allows to grant access to the scope of e.g., an individual host. In this case the scope equals the entity identifier, e.g. HOST-48B8F52F33098830.IN ,= ,!= ,startsWith ,NOT startsWithenvironment:management-zone - The name of a management zone. This condition is applicable to either: any settings object that is allowed on the scope of an entity that can be matched into a management zone or settings objects of the schemas builtin:alerting.maintenance-window, builtin:alerting.profile, builtin:anomaly-detection.metric-events, builtin:monitoring.slo and builtin:problem.notifications.IN ,= ,startsWithEnables writing of settings objects belonging to the schema
settings:schemaId - A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the object's schemaId property matches.IN ,= ,!= ,startsWith ,NOT startsWithshared:app-id - A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.IN ,NOT IN ,startsWith ,NOT startsWith ,= ,!=settings:schemaGroup - A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema of the object has a schemaGroup property that matches.IN ,=settings:entity.hostGroup - The host group attribute of an entity for which a setting is stored. This is e.g. useful to grant access to settings scopes of all hosts which belong to the same host group.IN ,= ,!=settings:scope - The exact scope identifier a setting object has or will have. This condition allows to grant access to the scope of e.g., an individual host. In this case the scope equals the entity identifier, e.g. HOST-48B8F52F33098830.IN ,= ,!= ,startsWith ,NOT startsWithenvironment:management-zone - The name of a management zone. This condition is applicable to either: any settings object that is allowed on the scope of an entity that can be matched into a management zone or settings objects of the schemas builtin:alerting.maintenance-window, builtin:alerting.profile, builtin:anomaly-detection.metric-events, builtin:monitoring.slo and builtin:problem.notifications.IN ,= ,startsWithEnables reading settings schemas
settings:schemaId - A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema's schemaId property of the schema matches.IN ,= ,!= ,startsWith ,NOT startsWithshared:app-id - A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.IN ,NOT IN ,startsWith ,NOT startsWith ,= ,!=settings:schemaGroup - A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema's schemaId property of the schema matches.IN ,=Enables using admin-mode to access, change ownership and share permissions of any object. Admin-mode only bypasses the ownership check - so to do anything useful, settings:objects:read and/or settings:objects:write are needed as well.
settings:schemaId - A string that uniquely identifies a single settings schema. The identifier of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the object's schemaId property matches.IN ,= ,!= ,startsWith ,NOT startsWithshared:app-id - A string that matches an app identifier. Only applicable to objects of schemas that have been added via apps. The condition will match if the object's app-id property matches.IN ,NOT IN ,startsWith ,NOT startsWith ,= ,!=settings:schemaGroup - A schema group that allows to address multiple individual schemas at once. The group of a schema can either be found via the dedicated schema endpoint in the Dynatrace Environment API or in the info box of a settings screen. The condition will match if the schema of the object has a schemaGroup property that matches.IN ,=SLO service
Grants permission to read Service-Level Objectives
Grants permission to write Service-Level Objectives
Grants permission to read Service-Level Objectives Templates
Unified analysis
Grants permission to read the screen definition of a unified analysis screen
SaaS Upgrade Assistant service
Grants permission to use the SaaS Upgrade Assistant app
Provides APIs to access vulnerabilities that are affecting customer environments
Allows viewing vulnerabilities
Allows modifying vulnerability related information