terraform-provider-dynatrace icon indicating copy to clipboard operation
terraform-provider-dynatrace copied to clipboard

Dashboard (non classic) deployment - restrict user permissions to deploy at tenant level instead of account level

Open ftmazzone opened this issue 2 months ago • 5 comments

Is your feature request related to a problem? Please describe. It is now possible to deploy documents like dashboard using dynatrace_documents but I don't know how to allow a user to deploy documents to a single tenant as the OAuth client configuration is not done at tenant level but account level.
That means that a user that can deploy documents can deploy documents in any tenants. This is an issue for the security of the production tenants.

Describe the solution you'd like Deploy dashboards with an access token or oauth client having its scope limited to a specific environment of the account.

Describe alternatives you've considered Deploying the dashboard manually instead of using Terraform

Additional context

Using this resource requires an OAuth client to be configured within your account settings. The scopes of the OAuth Client need to include Create and edit documents (document:documents:write), View documents (document:documents:read), Delete documents (document:documents:delete).

ftmazzone avatar Apr 15 '24 09:04 ftmazzone