Clarification on required scope and required permission for Dynatrace SDK for Dynatrace App

[StephenLHChan]

Hey,

I would like to confirm if my understanding to the access right control of Dynatrace App is correct or not.

Required scope:  the app setting so that this app can run certain SDK.

Required permission: if the user having the user permission so that he/she can run the app.

For this case, user needs to have 'environment:roles:viewer' permission and the app needs to specify "environment-api:credentials:read" in the appConfig.ts file so that this app can be run.

I found some SDK do not specify required permission. Does it mean that users do not need special permission to execute the SDK?

And, what if the user only have part of the permissions that the app required?

For example, if an app need users to have 6 different permissions, but the user only has 4 out of 6 permissions.  Will the error show when he/she click on the app (when he/she tried to open the app) or when he/she triggered the SDK that he/she does not have permission to do it?

Thanks.

[stefan_eggersto · Accepted solution]

Hi @StephenLHChan,

let me try to answer your questions:

For this case, user needs to have 'environment:roles:viewer' permission and the app needs to specify "environment-api:credentials:read" in the appConfig.ts file so that this app can be run.

This is correct. You can find this information also on https://developer.dynatrace.com/platform-services/services/classic-environment/#accessing-classic-en...

I found some SDK do not specify required permission. Does it mean that users do not need special permission to execute the SDK?

The "required permission" is only defined for the 2 Classic Environment API SDKs. All other SDKs, e.g. for the Document Service, require the user to have IAM policies assigned (see https://www.dynatrace.com/support/help/shortlink/iam-policystatements#document).

And, what if the user only have part of the permissions that the app required?

For example, if an app need users to have 6 different permissions, but the user only has 4 out of 6 permissions.  Will the error show when he/she click on the app (when he/she tried to open the app) or when he/she triggered the SDK that he/she does not have permission to do it?

They can still use the app, but certain functionality, e.g. storing a document, will result in a permission error whenever the SDK is used.

Let me know if that helps!

-Stefan

[StephenLHChan]

Hi @stefan_eggersto ,

Thanks for the reply.

It really helps.

I found one of the Classic Environment API SDK like the screenshot below does not specify the required permission. Does it mean that the users do not need any permission to execute this SDK?

Classic Environment V2 | Dynatrace Developer

[stefan_eggersto]

Good catch! This is a method which was specifically added to be accessed from apps.

The absence of required permission means that users can only access it when they have the environment-api:credentials:read IAM permission assigned. Their assigned roles (e.g. View environment or Manage monitoring settings) are not taken into account.