Skip to main content

Security Policy Guide 26.x

Use a Label Group in a Rule

Using a label group in a rule expands into multiple rules, and cross-communication is allowed.

For example, the Non-Prod label group is used again here, but in the rule, not the scope, which allows for cross-communication.

Scope:

  • App: HRM

  • Env: All

  • Loc: US

Rule:

  • Sources: Non-prod DB

  • Services: MySQL

  • Destinations: Non-prod DB

This means “allow MySQL from Non-Prod DB to Non-Prod DB for the HRM application in all environments located in the US," and would allow the following communication:

  • HRM | Dev | US | DB ← HRM | Dev | US | DB

  • HRM | Dev | US | DB ← HRM | QA | US | DB

  • HRM | Dev | US | DB ← HRM | Stage | US | DB

  • HRM | QA | US | DB ← HRM | Dev | US | DB

  • HRM | QA | US | DB ← HRM | Stage | US | DB