Scenario 2: Multiple matching FQDN destinations in different resources
Resource A -> “test.acme.com”.
Resource B -> “*.acme.com”.
Resource C -> “test.acme.com”.
Access policy rules:
- UserGroupA has access to Resource A
- UserGroupB has access to Resource B
- UserGroupC has access to Resource C
Behavior:
- Exactly like the IP/CIDR Scenario 1, all resources (A to C) would be identified for a request to “test.acme.com”.
- Exactly like Scenario 1, while such a request can be matched to any of rules #1 to #3 in terms of destination, matching to a rule also requires matching to the source and so access would be segregated based on user identity; i.e. user from UserGroupA would only ever match to rule #1, and so on.