Subscription Policies Advanced DSL Guide

This page details how users can create more complex policies using functions and variables in the Advanced DSL policy builder than the subscription policy builder allows.

Permissions

GOVERNANCE Immuta permission or Manage Policies domain permission

Build the policy

Policy negations must use !

Negations in advanced DSL policy conditions must use ! instead of not. The not syntax will be rejected and policy validation will fail. For example,

• Accepted policy: Allow users to subscribe when user @hasTagAsAttribute('Department', 'dataSource') and !(@isInGroups('Interns'))
• Rejected policy: Allow users to subscribe when user @hasTagAsAttribute('Department', 'dataSource') and not (@isInGroups('Interns'))

1. Click the Policies icon in the navigation menu.
2. Select the Subscription Policies tab.
3. Click New subscription policy and complete the Policy name field.
4. Select the type of subscription policy:

   1. Grant policy: Subscribe users to the data source if they meet the conditions of the policy.
   2. Guardrail policy: Prevent users from subscribing unless they meet the conditions of the policy. Some subscription levels listed below are unavailable for this policy type.
5. Select the access type you want to control:

   • Read Access: Control who can view the data source.
   • Write Access: Control who can view and modify data in the data source.
6. Select Allow users with specific groups/attributes, and then select Create using Advanced DSL.
7. Select the rules for your policy from the Advanced DSL options. For example, creating a @hasTagAsAttribute('Department', 'dataSource') would subscribe all users who have an attribute that matches a tag on a data source to that data source. So users with the attribute Department.Marketing would be subscribed to data sources with the tag Marketing.

Using @hasTagAsAttribute when dots (.) are used as characters in tags If you are using @hasTagAsAttribute to match an attribute value to a tag that contains a . as a character, you must escape the . in the attribute value (Marketing\.Analyst will match the Marketing.Analyst tag that uses . as a character). Otherwise, the tag and attribute values will not match, and your policy will not be enforced properly. For details, see the Policies page.

1. Check the Require Manual Subscription checkbox to turn off automatic subscription. Enabling this feature will require users to manually subscribe to the data source if they meet the policy.
2. If you would like to make your data source visible in the list of all data sources in the UI to all users, click the Allow Data Source Discovery checkbox. Otherwise, this data source will not be discoverable by users who do not meet the criteria established in the policy.
3. If you would like users to have the ability to request approval to the data source, even if they do not have the required attributes or traits, check the Request Approval to Access checkbox. This will require an approver with permissions to be set.
4. Select where this policy should be applied: On data sources, When selected by data owners, or On all data sources.
5. Click Activate Policy or Stage Policy.