Create and manage Access Policies

Each policy contains rules based on supported Cloud attributes. After you create the policy, assign it to a user from User Management > Users.

Before you begin

Before creating a policy:

• Confirm which Cloud data the users need to access.

• Identify the Cloud attributes that can define that access.

• Consider existing account, cost center, entity, and role restrictions that also apply to the users.

• Remember that only one Access Policy can be assigned to each user.

View Access Policies

Go to Admin > User Management > Access Policies to view and manage Access Policies.

The page displays:

• Policy Name — The name of the Access Policy.

• Policy Description — A short description of the policy purpose.

• Policy Rules — The rules configured for the policy.

• Actions — Edit or delete a custom Access Policy.

Use Search or Add Filter to find a policy when required.

Create an Access Policy

1. Go to Admin > User Management > Access Policies.

2. Click + ADD NEW.

   

3. On the New Access Policy dialog, complete the following fields:

   • Policy Name — Enter a name for the policy.

   • Policy Description — Enter a short description of the policy purpose.

   • Policy Rules — Click + CONFIGURE to define the Cloud data that the policy allows or excludes. At least one rule is required.

     

4. In the Policy Rules dialog, configure the rule:

   • Field — Select Cloud FOCUS Attributes or Cloud External Attributes.

     

   • Attribute — Select the Cloud attribute that you want to use for the rule.

   • Operator — Select the condition used to match the selected attribute.

   • Select or enter the required value for the condition.

5. Click + ADD CONDITION to add another condition, if required.

6. Click SAVE to save the Policy Rules and return to the New Access Policy dialog.

7. Review the policy, then click SAVE.

The new Access Policy appears in the Access Policy list and is available for assignment from User Management > Users.

Define policy rules

Policy Rules determine which Cloud data is available through an Access Policy.

For example, you might create rules based on cloud provider, billing account, application-related Cloud attributes, or other supported FOCUS or External attribute values.

Use filter conditions

Select the operator that best represents the required access.

Common conditions include:

• Equals — Match a specific value.

• Contains — Match values containing specific text.

• Starts With — Match values that begin with specific text.

Conditions such as Starts With can be useful when accounts or other Cloud values follow a consistent naming convention. This can reduce the need to select each value individually.

Access Policies can also use exclusion conditions when specific Cloud data must be excluded.

Examples

Restrict access to one cloud provider

To allow access only to AWS Cloud data:

1. Add a rule using the cloud provider attribute.

2. Select Equals.

3. Select or enter AWS.

4. Save the policy.

Restrict access by billing account

To allow access to a specific billing account:

1. Select the billing account attribute.

2. Select Equals.

3. Select the required billing account.

4. Save the policy.

Use a naming pattern

If permitted account names begin with FIN-:

1. Select the appropriate account attribute.

2. Select Starts With.

3. Enter FIN-.

4. Save the policy.

The policy matches Cloud data whose selected attribute begins with the specified value.

Edit an Access Policy

You can edit a custom Access Policy when the user's Cloud access requirements change.

1. Go to Admin > User Management > Access Policies.

2. Locate the custom Access Policy you want to update.

3. In the Actions column, click the Edit icon.

4. Update the policy name, description, or Policy Rules as required.

5. Click SAVE.

Review the impact on assigned users before changing an existing policy.

Delete an Access Policy

You can delete a custom Access Policy only when it is not assigned to any users.

1. Go to Admin > User Management > Access Policies.

2. Locate the custom Access Policy you want to delete.

3. In the Actions column, click the Delete icon.

If the policy is currently assigned, change or remove those assignments before deleting the policy.

Next step

Assign the policy to the required user from User Management.

See Assign and manage a user's Access Policy.

Related content

• Access Policies

• Assign and manage a user's Access Policy

• User Management