Scenario 4: Tie-breaker scenarios for multiple valid resource destinations in matched rule
Resource A -> 10.10.10.10.
Resource B -> 10.10.10.10 (same port and protocol as Resource A).
Resource C -> 10.10.10.0/24.
Access policy rules:
- UserGroupA has access to Resource A OR Resource C.
- UserGroupB has access to Resource A OR Resource. The resulting behavior is:
- Like the earlier scenarios, a request to “10.10.10.10” would match to all resource (A to C).
- Like the earlier scenarios, a request from user in UserGroupA would match to rule #1, and for UserGroupB would match to rule #2, for the same “10.10.10.10” destination.
- Unlike earlier scenarios, both rules have multiple destination resources that all map to the “10.10.10.10” destination.
- For rule #1, since Resource A (10.10.10.10) is more specific than Resource C (10.10.10.0/24), access will be provided to Resource A.
- For rule #2, since Resource A and B are identical in all sense (10.10.10.10 with same port and protocol), we will arbitrarily pick one to provide access.