Using resources

Overview

This topic explains how to specify different resources to use with roles, integrations access, and Relay Proxy access.

When you create or update a role, you specify resources that the role can or cannot access. Then, you grant access to a specific set of actions associated with that resource.

To learn more about how resources are structured within role policies, read Member role concepts.

Specifying resources in the policy builder

When you create a policy statement using the policy builder, you use the Scope menu to specify the resources that the policy affects:

Some resources are “scoped” within specific parent resources and require additional context to be correctly identified. For example, feature flags are scoped within a project and environment. In the policy builder, if you initially select the “flag” resource type, the policy builder prompts you to specify projects and environments before you can continue.

You can define the resources explicitly in the policy statement for a role, as in the screenshot above. Alternatively, you can define them based on a parameter that you create.

This parameter is called a role attribute. You define the role attribute when you create the role, and then you set the value of the role attribute when you assign the role to a member, either directly or through a team. For example, you can define the role attribute projectAttribute, and set the value of the role attribute to “Project A” when you assign the role to member A. Then you can set the value of the role attribute to “Project B” when you assign the role to member B. Role attributes are available for all resource types.

Specifying resources in the advanced editor

When you create a policy statement using the advanced editor, you specify resources in JSON. LaunchDarkly uses a resource specifier syntax to name resources or collections of resources. This is a precise, flexible taxonomy that lets you identify and control any resource in your LaunchDarkly account.

The syntax to specify a resource looks like this:

resource-type/name;tag1,tag2,{property-based-selector:value}

The example above shows two tags separated by a comma, which means the resource must have both tag1 AND tag2. Tags are optional. To learn more about building policies with tags, read Using tags.

The example also shows a property-based selector, which is a way to select resources whose properties match a particular value. To learn more, read Property-based selectors.

If you don’t need to use any tags or selectors, you can omit the semicolon (;) and all content following.

Some resources are “scoped” within specific parent resources and require additional context to be correctly identified. For example, feature flags are scoped within a project and environment.

You can name scoped resources by using the resource syntax structure depicted below:

resource-type/name;tag1,tag2:resource-type/name;tag3,tag4,tag5

The following example names all feature flags across all environments:

proj/*:env/*:flag/*

In the example above, proj/*:includes all named projects in the list of results. env/*: includes all environments in the list of results. flag/*: includes all flags in the list of results. This example will return very broad results because of how comprehensive its permissions are.

For a more refined example, you could name all feature flags whose keys start with ops_:

proj/*:env/*:flag/ops_*

Finally, you could name all feature flags in critical environments:

proj/*:env/*;{critical:true}:flag/*

Additional examples of resource specifier syntax

Expand the section below to review additional examples of resource specifier syntax. You only need this information if you are creating your policy statements in JSON. You do not need to review this information if you use the policy builder.

proj/*

proj/default

proj/*;mobile

About resource types and scopes

To review which resources the LaunchDarkly preset roles have access to:

1. Click the gear icon in the left sidenav to view Organization settings.
2. Click Roles and find the role you wish to review. LaunchDarkly provides both project and organization preset roles. Select the Project or Organization tab as needed.
3. Click the role name. A summary of the role and its policy statements appears.
4. (Optional) Click View JSON to view the specific resources listed out by written expression.

To review which resources the LaunchDarkly base roles and preset roles have access to, expand the section below. It contains a reference list of all the supported resources in LaunchDarkly, their scopes, the role that has access to the resource, and the resource identifier, ordered by written expression.

You only need this information if you are creating your policy statements in JSON. You do not need to review this information if you use the policy builder. In the policy builder all of the supported resources are available directly in the user interface.

For a list of all actions available to each resource, read Using actions. To learn more about how to create roles with access to these resources, read the Creating roles guide.