> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/troubleshooting-and-resources/armory/general/restrict-application-creation.md).

# Restrict Application Creation

### Introduction <a href="#introduction" id="introduction"></a>

Before version 2.17, there was no way to prevent application creation in Spinnaker. In Armory Spinnaker 2.17 and later, Fiat can now control application creation through the use of a new permission option: `CREATE`. **Note**: When configuring permissions, you must explicitly configure permissions for each user role. The default for a user role is no permissions, which means it cannot perform any actions. This document assumes that you have enabled and configured Fiat. **This was tested on version 2.17 and may change in later versions.**

### Prerequisites <a href="#prerequisites" id="prerequisites"></a>

Fiat Needs to be Enabled

### Instructions <a href="#instructions" id="instructions"></a>

Fiat is the authorization (authz) microservice of Spinnaker, which looks for the permissions from different sources. In 2.17, a new sources were added, providing more flexibility for applying permissions. This page focuses on the `prefix` source to control permissions for any applications whose name starts with a given prefix. To use this functionality, you need to enable Fiat to use the new sources and set prefixes as one of the sources. `auth.permissions.source.application.prefix`. Perform the following steps:

* In `fiat-local.yml`, set the value for `auth.permissions.provider.application` parameter to `aggregate`.
* Add prefixes as a source:

```yaml
auth.permissions.source.application.prefix:
  enabled: true
```

Define the permissions for a prefix:

```yaml
- prefix:
  permissions:
    READ:
      - ""
      - ""
      - ""
    WRITE:
      - ""
    EXECUTE:
      - "user role n>"
```

The below example does the following:

* Enables Fiat to read from the new sources.
* Sets `prefix` as one of these new sources.
* Defines the prefix `apptest-x`. Defines permissions for all applications that match the prefix `apptest-*` based on roles:
* Add READ, WRITE and EXECUTE permissions to `role-one`.
* Add READ permissions to `role-two`.

In the Halyard Profiles folder, in the `fiat-local.yml` file add to or create the file if it doesn't exist:

```yaml
auth.permissions.provider.application: aggregate
auth.permissions.source.application.prefix:
  enabled: true
  prefixes:
    - prefix: "apptest-*"
      permissions:
        READ:
          - "role-one"
          - "role-two"
        WRITE:
          - "role-one"
        EXECUTE:
          - "role-one"
```

As a result, any application that matches the prefix `apptest-*` with `role-two` are read-only. To restrict application creation specifically, add `fiat.restrictApplicationCreation` and set it to `true`:

**Note:** Currently, the prefix source is the only source that support the CREATE permission.

In the Halyard Profiles folder, in the `fiat-local.yml` file:

```yaml
fiat.restrictApplicationCreation: true
auth.permissions.provider.application: aggregate
auth.permissions.source.application.prefix:
  enabled: true
  prefixes:
    - prefix: "*"
      permissions:
        CREATE:
          - "role-one"
        READ:
          - "role-one"
          - "role-two"
        WRITE:
          - "role-one"
        EXECUTE:
          - "role-one"
```

The above example assigns CREATE permission to users with the `role-one` role. Users without the `role-one` role cannot create any applications in Spinnaker because only `role-one` has CREATE permission.

* Finally, apply your configuration changes to Spinnaker by running the following command: `hal deploy apply`.

{% @harness-feedback/feedback %}