Scoped roles in Cloud
Limited Availability
Note
Currently, this is accessible to only a limited number of organizations.
You can limit what a user sees in Cloud by giving them a scoped Policy Viewer role. The Policy Viewer role gives read-only access to policies within a specified scope. It can't edit policies or rules. See Roles with Custom Scopes.
A scope is a set of labels, such as App=Payments and Env=Prod. In Cloud, the user sees only the cloud resources, traffic, applications, and policies that match their scope. Everything else is hidden.
For example, a platform team creates the application labels and owns the Cloud environment. To let each application owner see only their own applications, the platform team gives each owner a Policy Viewer role scoped to that owner's applications. An owner of App 1 and App 2 then sees the resources, traffic, map, and policies for those applications, and nothing else. Application owners can view policies but can't change them.
Before you begin
Your organization must use unified roles, which require a custom subdomain for the Illumio Console. See Custom Subdomains for Illumio Console.
In Cloud, only the Policy Viewer role can be scoped. Other scoped roles, such as Policy Manager and Policy Provisioner, don't apply to Cloud yet.
You assign scopes in → , the same way as for other Illumio products. Cloud has no separate setup.
Label your cloud resources before you assign scoped roles. Resources without labels are visible only to users with an unscoped role.
How scopes work
Labels in one scope must all match. A scope of
App=PaymentsandEnv=Prodshows only resources that have both labels. Other labels on a resource don't matter.Label types that a scope leaves out aren't limited. A scope of
App=Orderingshows Ordering resources and applications in every environment, such as Prod and Dev. A scope ofEnv=Prodshows every application in Prod.Multiple scopes add up. A user with one scope of
App=Paymentsand another ofApp=CRMsees resources that match either.A role with no scope shows everything the role allows.
Scopes only narrow access. If a user also has an unscoped role, they see everything in the organization.
Hidden means absent. Out-of-scope items don't appear at all. They aren't grayed out. A direct link to an out-of-scope item shows a "not found" error. An empty page means that nothing matches the user's scope. It isn't an error.
Label changes show on the next page load. When a resource's labels change, scoped users see the change the next time they load the page.
What scoped users see
Page | What a scoped user sees |
|---|---|
Inventory | Resources in their scope, plus the subnets, VPCs/VNets, and peering connections needed to show where those resources sit. |
Traffic | Flows where at least one end is in their scope. For the other end, the user sees only the IP address, port, hostname, and labels. |
Cloud Map | Resources in their scope and the traffic between them. Traffic to or from resources outside the scope doesn't appear. Scoped users don't see the default map. Cloud Map opens with a filter bar, and the user selects filters to show resources. |
Applications | Applications whose labels match their scope. For example, a user scoped to |
Policy | Policies whose scope is the same as or narrower than the user's scope. Rule search shows rules where a label in the user's scope appears in the source or destination. |
Labels | All labels |
On Inventory, Traffic, and Cloud Map, label filters show only the labels in the user's scope.
Scoped users can't open these Cloud pages:
Cloud Dashboard
Onboarding
Security Review
Reports
App Discovery, including Application Definitions
Events
Usage
Reports that a user created before getting a scoped role stay in place, but only users with an unscoped role can see them.
Scoped users can't create, edit, delete, approve, or provision anything in Cloud, and they can't change enforcement mode.