PingOne Privilege

Managing policies

Policies automatically grant permissions to users or groups based on predefined criteria. They’re ideal for managing time-based access for projects with fixed durations.

Creating an access policy for targets

Before you begin

You must ensure resource management is enabled:

  1. In the PingOne Privilege admin console, go to Cloud > Targets.

  2. In the list, find the resource and click More Info.

  3. Click the Managed toggle to enable it.

    Result:

    The resource can now have a policy created for it.

Steps

To create a policy that grants access to a specific target, such as a server or database:

  1. In the PingOne Privilege admin console, go to Cloud > Targets.

  2. Locate the target you want to grant access to and click More Info.

  3. On the target details page, click Create Policy.

    Some resources require an additional Principal selection step:

    • Server: Manually enter the principal for Secure Shell (SSH).

    • Database: Configure database access using stored credentials or cloud IAM before selecting the principal in the Enter Principal field.

    • RDP: Principals must be configured beforehand in Infrastructure > RDP User Management. Learn more in Configuring remote desktop access. Select the principal in the Enter Principal field.

    • Kube Cluster: You must have a configured app role.

  4. Click Continue.

  5. Select the users or groups to grant access to through this policy. Click Continue.

  6. Enter a Policy Name and define the policy’s active period by setting a Start Date, Start Time, End Date, and Hours.

  7. Click Submit to save and activate the policy.

Creating an access policy for cloud resources

To create an access policy for a cloud resource:

  1. In the PingOne Privilege admin console, go to Cloud > Resources.

  2. In the Resource Catalog, find the resource you want to create a policy for. Click Policy.

  3. In the list, select one or more identity and access management (IAM) roles to include in the policy. Click the Plus icon () to add them to the queue. When you’ve selected all the roles to include, click Add To Request Queue.

  4. When you’ve added all necessary resources, click Continue.

  5. Enter a Policy Name and define the policy’s active period by setting a Start Date, Start Time, End Date, and Hours.

  6. Click Submit to save and activate the policy.

Editing an access policy

You can edit the users, resources, and expiry of an active policy.

  1. In the PingOne Privilege admin console, go to Access Management > Access Policies.

  2. Locate the policy you want to edit and click More Info.

  3. Click Edit. You can edit the following policy categories:

    • Resources: Add additional resources to the policy.

    • User/Groups: Add or remove users or groups to the policy.

    • Extend Expiry: Extend the expiry of the policy.

Deleting an access policy

To delete a policy:

  1. In the PingOne Privilege admin console, go to Access Management > Access Policies.

  2. Locate the policy you want to delete and click More Info to open the policy details page.

  3. Click Delete Policy.

  4. In the confirmation modal, click Delete.

    Result:

    The policy is immediately deleted.