Skip to main content

Share Resources with Environments

A resource grant makes a resource (a VPC, a Kubernetes cluster, a database) usable by other environments as a remote reference or environment default. Without a grant, an environment cannot consume the resource, even if its members can see it in the resources list.

Grants match recipient environments by attribute. An environment's attributes include its own tags plus everything cascaded from its project, so you can target by environment (md-environment), by project (md-project), or by any custom tag on either.

Prerequisites​

  • resource:grant on the resource. Provisioned resources carry their project's attributes, so a group policy granting resource:grant on a team's projects covers everything they deploy. Org admins have it everywhere.
  • Optionally, a custom attribute at project or environment scope (e.g. team, pci) to target recipients by tag.

1. Tag the recipient environments​

Open the environment's Settings and set the attribute (e.g. stage = nonprod). To cover every environment in a project at once, set the attribute on the project instead.

Prefer the CLI?
mass environment update ecomm-staging -a stage=nonprod
mass project update ecomm -a team=payments

2. Create the grant​

Open the resource (from the owning instance's Resources tab, or from the org Resources list), go to the Grants tab, and click Add Grant. Set the action to resource:export and the recipient conditions.

Recipient conditions​

Each condition is a key and one or more values. An environment matches when it has every key with one of the listed values. Add more conditions to narrow the match, add more values to widen it. Use * as the value to match any environment that has the key at all. Project attributes cascade to environments, so project tags work here too.

Share withKeyValues
Every environment with the id staging in any projectmd-environmentstaging
Every environment in the project with id ecommmd-projectecomm
Every environment in projects with the custom attribute team equal to paymentsteampayments
Every environments with the custom attribute stage equal to nonprodstagenonprod
Prod and staging in PCI projects (two conditions)md-environment
pci		prod staging
true
Every environment in the org**

Grants can also be managed through the GraphQL API and the Terraform provider. Full matching rules are in Access Control.

3. Consume the resource​

In a recipient environment, set the resource as an environment default or pick it as a remote reference on an instance. The environment can only consume resources with a grant that covers it.

Prefer the CLI?
# environment default
mass environment default ecomm-staging si-staging-k8s-cluster

# remote reference on an instance's connection slot
mass instance remote-reference set ecomm-staging-api kubernetes_cluster si-staging-k8s-cluster

If the resource is missing, check:

  • The environment's effective attributes match the grant's conditions.
  • Your group has resource:view on the resource (grants control use; policies control view).

Revoke​

Grants are immutable. To change one, delete it from the resource's Grants tab and create a new one.