hybrid - missing fine-grain role assignments ( scoped to proxy )

Google Cloud Apigee
1

With OPDK, platform administrators could explicitly grant permissions to specific proxies - “proxy1” “proxy2” … etc. This would allow for tight-controls on who is allowed to modify or trace the proxy.

For instance, we have a shared “authentication proxy”, which only CIAM/Identity developer have access. No other users should access

Questions

  • “Environment access” seems to grant higher-level roles - all or nothing. See image. Doesn’t have ability to differentiate between proxy, api product

  • GCP-IAM does not provide/allow-for fine-grain restrictions from UI.

  • Has anyone tried to create a specific policy at the resource-level ? (product, proxy or entitlement)

apigeeroles_hybrid.png
apigeeroles_hybrid.png832×649 40.3 KB

2

In hybrid the capability is there, but it’s available differently. You should be able to do this in X or hybrid with Conditional IAM

Read about it here: https://cloud.google.com/apigee/docs/api-platform/system-administration/add-iam-conditions

Let me know if this satisfies your requirement.