Security and access for sharing dashboards and charts

When you share dashboards or charts publicly via live URLs, it exposes sensitive data to external viewers, so it's critical to manage access and permissions carefully. Ensure you have the following setups as per your requirement to securely share dashboards and charts.

Each of the following personas has specific responsibilities in this process:

Authentication domain manager: Controls the feature's enablement in account level.
Administrator: Configures custom roles and permissions for users to manage live URLs.

Policy enablement

For sharing dashboards publicly, the Authentication domain manager needs to check and enable the Live URL Creation policy at the account level. This is not applicable to chart sharing. The Authentication domain manager can check the status of this policy in accounts, and enable or disable it only via NerdGraph API.

As an Authentication Domain Manager, you can check the current status of the Live URL Creation policy in specific accounts. Use the NerdGraph API explorer to construct a graph API call as follows. Replace 1, 2, 3 with actual account IDs. If you don't provide the account IDs, the call returns the status of your authorized account. You can query up to 100 accounts simultaneously.

{
  actor {
    dashboard {
      liveUrlCreationPolicies(filter: {
        accountIds: [1, 2, 3]
      }) {
        liveUrlCreationPolicies {
          accountId
          liveUrlCreationAllowed          
        }
      }
    }
  }
}

This is a sample response.

{
{
  "data": {
    "actor": {
      "dashboard": {
        "liveUrlCreationPolicies": {
          "liveUrlCreationPolicies": [
            {
              "accountId": 1,
              "liveUrlCreationAllowed": true
            },
            {
              "accountId": 2,
              "liveUrlCreationAllowed": false
            }
          ]
        }
      }
    }
  }
}

As an Authentication Domain Manager, you can enable or disable the Live URL Creation policy in specific accounts. Ensure you have authorization for these accounts. Use the NerdGraph API explorer to construct a graph API call as given here with the following changes:

Replace 1, 2, 3 with actual account IDs.

Set liveUrlCreationAllowed to true to enable the policy, or false to disable it.

You can query up to 100 accounts simultaneously. Each successful update triggers an audit event for the corresponding account ID.

mutation {
  dashboardUpdateLiveUrlCreationPolicies(
    policies: {
      accountIds: [1,2], 
      liveUrlCreationAllowed: true}
  ) {
    liveUrlCreationPolicies {
      accountId
      liveUrlCreationAllowed
    }
  }
}

This is a sample response. If you have provided an unknown account ID, the response will show UNAUTHORIZED error code.

{
  "data": {
    "dashboardUpdateLiveUrlCreationPolicies": {
      "liveUrlCreationPolicies": [
        {
          "accountId": 1,
          "liveUrlCreationAllowed": true
        },
        {
          "accountId": 2,
          "liveUrlCreationAllowed": true
        }
      ]
    }
  }
}

Access management

As an Administrator, perform the following steps to grant access to a user for managing live dashboard and chart URLs. Check with the user about their specific needs and accordingly do the configuration. To learn more about user management, refer to User management tutorial.

Add permissions to a custom role

Create a new custom role with the following permissions, or add them to an existing role. Check with the user to understand the level of access required.

Live Url (all): Access details of live URLs for all users.
- View: Can see all live URL details.
- Delete: Can revoke any live URL.
Live Url (individual): Access details of live URLs owned by the user.
- View: Can see own live URL details.
- Modify: Can update the properties of the live URLs.
- Delete: Can revoke own live URLs.

Add user, role, and account to a group

For dashboard sharing configuration, create a new group or manage an existing group as follows:

Navigate to New Relic Administration > Access Management > Groups.
Click Create a new group, or select Manage group access from the menu of an existing group.
For a new group, provide a name and click Create group. The Admin pane for the group opens.
Under Members, add the user.
Under Account access, associate the custom role with the desired account for dashboard sharing.
If the dashboard is sourced from multiple accounts, under Account access, include the custom role for each relevant account within the group.
Tip
Ensure you have the sharing capabilities defined for all accounts queried in the dashboard.

To learn how to create and manage live URLs, refer to Share dashboards and charts publicly.

Security and access for sharing dashboards and charts

Policy enablement

Check status of the Live URL Creation policy status in accounts

Enable or disable the Live URL Creation policy in accounts

Access management

Add permissions to a custom role

Add user, role, and account to a group

Tip

Security and access for sharing dashboards and charts

Policy enablement .css-21sua1{background:none;border:none;width:0;padding:0;}

Enable or disable the Live URL Creation policy in accounts

Access management

Add permissions to a custom role

Add user, role, and account to a group

Tip

Policy enablement