As an Authentication Domain Manager, perform the following steps to grant access to a user for managing account and metrics cardinality. Check with the user about their specific needs and accordingly do the configuration. To learn more about user management, refer to User management tutorial.
Important
If the user needs to change cardinality budgets through NerdGraph or Terraform, see Permissions for NerdGraph and Terraform.
Add permissions to a custom role
Create a new custom role with the following permissions, or add them to an existing role. Check with the user to understand the level of access required.
Manage account cardinality: Adjust the cardinality budget of the account.View: Can see the cardinality budget of the account.Modify: Can update the cardinality budget of the account, in the UI or through NerdGraph or Terraform.
Manage metric cardinality: Adjust the cardinality budget of metrics.View: Can see the cardinality budget of the metrics.Modify: Can update the cardinality budget of the metrics, in the UI or through NerdGraph or Terraform.
Manage pruning rules: Manage pruning rules for metrics.View: Can see the pruning rules of the metrics.Modify: Can create and delete pruning rules for the metrics.
Customer limits management: Adjust limits of different capabilities in the account including cardinality.View: Can see the limits available for the capabilities.Modify: Can adjust the limits of the capabilities, but not cardinality budgets through NerdGraph or Terraform.
Add user, role, and account to a group
For the cardinality management, create a new group or manage an existing group as follows:
- Navigate to New Relic Administration > Access Management > Groups.
- Click Create a new group, or select Manage group access from the menu of an existing group.
- For a new group, provide a name and click Create group. The Admin pane for the group opens.
- Under Members, add the user.
- Under Account access, associate the custom role with the desired account for cardinality management.
- If cardinality management involves multiple accounts, under Account access, include the custom role for each relevant account within the group.
Permissions for NerdGraph and Terraform
You can change account and per-metric cardinality budgets in the Cardinality Management UI, through NerdGraph, or with the New Relic Terraform provider. To change a cardinality budget through NerdGraph or Terraform, the user needs the cardinality permission for that budget on each account they change:
| Action | Required permission for NerdGraph or Terraform |
|---|---|
| Adjust the account cardinality budget | Manage account cardinality: modify |
| Adjust a per-metric cardinality budget | Manage metric cardinality: modify |
Customer limits management: modify doesn't let a user change cardinality budgets through NerdGraph or Terraform. It still controls the other limits in the account.
NerdGraph and Terraform requests use a user key, so the request has the permissions of the user who owns the key. Add the permissions to that user's role, and add the role to the group for every account the key will change.
Important
If NerdGraph or Terraform returns a Not authorized error when changing a cardinality budget, check that the user who owns the key has the permission from the table above on that account. Automation that used to work with only Customer limits management: modify now needs the cardinality permissions. In NerdGraph, you change cardinality budgets with the dataManagementCreateAccountLimit mutation, using the limits named Dimensional Metric account cardinality ingested per day and Dimensional Metric per-metric cardinality ingested per day.
Related topics
Manage cardinality
Learn how to maintain cardinality within its budget, and when needed how to adjust it.
Monitor cardinality
Learn how to monitor cardinality usage.
Understand and query high cardinality metrics
Understand the concept of cardinality and learn how to query and analyze high cardinality metrics using NRQL.