Contextes d’autorisation

La portée (ou scope) est un mécanisme d’autorisation vous permettant de définir et de restreindre l’accès granulaire dont les applications disposent pour les données Datadog d’une organisation. Lorsque des applications sont autorisées à consulter des données au nom d’un utilisateur ou d’un compte de service, elles peuvent uniquement accéder aux informations explicitement demandées.

Pour gérer au mieux les autorisations, il est recommandé de définir des contextes restrictifs et d’accorder l’accès minimal requis pour garantir le bon fonctionnement des applications. Les utilisateurs peuvent donc contrôler précisément les applications et vérifier facilement comment leurs données sont utilisées. Ainsi, il est inutile d’attribuer des autorisations de gestion ou de suppression d’utilisateurs dans une organisation à une application tierce qui est uniquement censée lire des données de dashboards.

Dans Datadog, les contextes peuvent être appliqués de deux façons différentes :

AuthN Mappings, Logs Restriction Queries, Roles, Users

CI Visibility Pipelines, CI Visibility Tests

Dashboard Lists, Dashboards, Powerpack

Downtimes, Monitors

Events

Scope name

Description

Endpoints that require this scope

Incident Services, Incident Teams, Incidents

Metrics

Security Monitoring

Scope name

Description

Endpoints that require this scope

security_monitoring_filters_read

Read Security Filters.

security_monitoring_filters_write

Create, edit, and delete Security Filters.

security_monitoring_findings_read

View CSPM Findings.

security_monitoring_rules_read

Read Detection Rules.

security_monitoring_rules_write

Create and edit Detection Rules.

Service Definition, Service Scorecards

Scope name

Description

Endpoints that require this scope

apm_service_catalog_read

View service catalog and service definitions.

apm_service_catalog_write

Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.

Service Level Objective Corrections, Service Level Objectives

Scope name

Description

Endpoints that require this scope

slos_corrections

Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.

Synthetics

Scope name

Description

Endpoints that require this scope

synthetics_global_variable_read

View, search, and use Synthetics global variables.

synthetics_global_variable_write

Create, edit, and delete global variables for Synthetics.

synthetics_private_location_read

View, search, and use Synthetics private locations.

synthetics_private_location_write

Create and delete private locations in addition to having access to the associated installation guidelines.

Teams

Scope name

Description

Endpoints that require this scope

teams_manage

Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.

Usage Metering

Scope name

Description

Endpoints that require this scope

usage_read

View your organization's usage and usage attribution.

Get the list of available daily custom reports
Get specified daily custom reports
Get the list of available monthly custom reports
Get specified monthly custom reports
Get hourly usage for analyzed logs
Get usage attribution
Get hourly usage for audit logs
Get hourly usage for lambda
Get billable usage across your account
Get hourly usage for CI visibility
Get hourly usage for CSM Pro
Get hourly usage for cloud workload security
Get hourly usage for database monitoring
Get hourly usage for Fargate
Get hourly usage for hosts and containers
Get hourly usage attribution
Get hourly usage for incident management
Get hourly usage for indexed spans
Get hourly usage for ingested spans
Get hourly usage for IoT
Get hourly usage for logs
Get hourly logs usage by retention
Get hourly usage for logs by index
Get monthly usage attribution
get hourly usage for network flows
Get hourly usage for network hosts
Get hourly usage for online archive
Get hourly usage for profiled hosts
Get hourly usage for RUM units
Get hourly usage for RUM sessions
Get hourly usage for sensitive data scanner
Get hourly usage for SNMP devices
Get usage across your account
Get hourly usage for synthetics checks
Get hourly usage for synthetics API checks
Get hourly usage for synthetics browser checks
Get hourly usage for custom metrics
Get all custom metrics by hourly average
Get hourly usage for application security
Get cost across multi-org account
Get estimated cost across your account
Get historical cost across your account
Get hourly usage by product family
Get hourly usage for lambda traced invocations
Get hourly usage for observability pipelines
Get projected cost across your account

Webhooks Integration

Scope name

Description

Endpoints that require this scope

create_webhooks

Create webhooks integrations.