Attribute-based access control
Attribute-based access control (ABAC) grants access to Harness resources based on attributes associated with those resources, such as connector type or environment type. ABAC is an optional extension of Role-based access control (RBAC) that uses attribute-based rules to grant access in the context of specific actions. Use ABAC to refine resource groups with an additional dimension of control.
What will you learn in this topic?
By the end of this topic, you will be able to:
- Understand how ABAC works and when to use it to extend RBAC.
- Configure ABAC on a resource group.
- Follow the next steps to combine roles with ABAC-enhanced resource groups and complete your RBAC setup.
Before you begin
Before you configure ABAC, ensure you have the following:
- Harness account access: Admin permissions for the account, organization, or project where you configure ABAC.
- RBAC knowledge: Familiarity with roles and resource groups. Go to RBAC in Harness to know how roles and resource groups grant access.
- Existing resource group: A resource group to refine, or permissions to create one. Go to Manage resource groups to manage existing resource groups.
How ABAC works
RBAC is role-based, which means permissions and access to resources are determined by the roles assigned to users, user groups, and service accounts. ABAC adds a dimension to this model by granting access based on the type of a resource rather than a specific named resource.
ABAC can help you:
- Simplify management: Manage role bindings at scale with fewer, broader rules.
- Refine access: Provide more fine-grained access control.
- Reduce overhead: Reduce the number of role bindings you need to manage.
- Add business meaning: Leverage attributes with specific business meanings.
ABAC adds the dimensions of connector and environment types to refine resource groups. For example:
- Grant access to manage pre-production environments but not other types of environments.
- Grant access to manage code repository connectors but not other types of connectors.
Configure ABAC
Configure ABAC on a resource group to scope access by connector and environment type. You configure ABAC while you create or edit a resource group.
-
For Resources, select Specified.
-
Select Environments and/or Connectors.
ABAC is available for environments and connectors only. These steps focus on configuring ABAC; however, your resource groups can include other resource categories. Go to Manage resource groups to configure other resource categories.
-
To apply ABAC to Connectors or Environments, select By Type, and then click Add.
For information about the All and Specified options, go to Manage resource groups.
ABAC is in addition to the Resource Scope. For example, if the Resource Scope is Project Only, and you select connectors By Type, then the resource group includes all connectors of the selected types that are in the specified project only. Go to scopes and refinement for more information on how scope and ABAC interact.
-
Select the types to include, and then click Add.
For Environments, you can choose Production or Pre-Production.
For Connectors, you can choose one or more of the following Harness connector types: Artifact Repositories, Cloud and AI Costs, Cloud Providers, Code Repositories, Communication Tools, Documentation, Monitoring and Logging Systems, Secret Managers, and Ticketing Systems.
-
Click Save.
Next steps
Pair your ABAC resource group with a role, then assign both to your users. Because ABAC applies to environments and connectors, choose a role that includes environment or connector permissions.
- Configure RBAC in Harness: Complete the end-to-end workflow that ties resource groups, roles, and assignments together.
- Roles: Create the role that grants the environment and connector permissions your ABAC resource group needs.
After you configure roles and resource groups, assign them to: