Policy Example

The following example policy illustrates the importance of the scope in which a policy is defined, the impact of policy inheritance, and the use of inventory filters to create precise policies or policies that apply to workloads in multiple scopes.

Consider the following example involving three scopes:

• Apps

  and its child scopes

  • Apps:HR and

  • Apps:Commerce

In addition, the inventory filters PRODUCTION and NON-PRODUCTION specify production and nonproduction hosts, respectively. (You can define an inventory filter to apply to hosts within a scope or across scopes.)

Assume that the following policy is defined in the Apps scope:

DENY PRODUCTION -> NON-PRODUCTION on TCP port 8000 (Absolute)

Since this policy is an absolute policy that is defined in the primary workspace under the Apps scope, it affects all PRODUCTION/NONPRODUCTION hosts that are members of the Apps scope, including members of its descendant scopes (hosts that belong to the Apps:HR and Apps:Commerce scopes).

Now consider the case where the exact same policy is defined under the workspace that is associated with the Apps:HR scope. In this scenario, the policy can only affect PRODUCTION/NONPRODUCTION hosts that are members of the Apps:HR scope. More precisely, this policy results in inbound rules on NONPRODUCTION HR hosts (if any) denying connections on TCP port 8000 from any PRODUCTION host, and outbound rules on PRODUCTION HR hosts (if any) dropping connection requests to any NONPRODUCTION host.