# Folder Object Management

The Folder Mapping feature allows you to organize and control access to logs objects by associating them with folders. This provides a hierarchical structure for managing favorite facets, lookup tables, and scheduled views with granular access control.

|     |     |
| --- | --- |
|  | Folder mapping requires the `EnableFolderMapping` feature flag to be enabled in your Kloudfuse configuration. Contact your system administrator if this feature is not available. |

## Overview

Folder mapping extends Kloudfuse’s existing folder-based access control system to logs objects, enabling you to:

- **Organize logs objects** hierarchically using Grafana folders
- **Control access** through Grafana folder permissions (view/edit)
- **Inherit permissions** from folder structure for seamless security management
- **Maintain consistency** between logs objects and their associated folders

### Supported Entity Types

The following logs objects support folder mapping:

| Entity Type       | Description                                                    |
| ------------------| -------------------------------------------------------------- |
| **Favorite Facets** | Individual facets saved for quick access in logs queries      |
| **Lookup Tables**   | Dimension tables for data enrichment and filtering            |
| **Scheduled Views** | Pre-computed views that run on schedules for faster querying  |

## Prerequisites

Before using folder mapping, ensure:

1. The `EnableFolderMapping` feature flag is enabled in your system configuration
2. You have appropriate permissions in Grafana to create and manage folders
3. You understand your organization’s folder structure and permission model

## Managing Folder Mappings

### Mapping Objects to Folders

When creating or editing logs objects, you can assign them to folders:

#### For Favorite Facets
1. Navigate to **Logs** and create or edit a favorite facet
2. In the facet configuration, select the desired folder from the **Folder** dropdown
3. The facet will inherit the folder’s access permissions

#### For Lookup Tables
1. Navigate to **Lookup Tables** and create or edit a table
2. Assign the table to a folder during the creation/editing process
3. Users need **edit** permissions on the folder to modify the lookup table

#### For Scheduled Views
1. Navigate to **Scheduled Views** and create or edit a view
2. Select the appropriate folder to control who can access and modify the view
3. The view inherits the folder’s permission structure

### Viewing Objects with Folder Assignments

When viewing your logs objects, the folder assignments are displayed in the list view:

This view allows you to quickly identify which folder each object belongs to and understand the access control structure at a glance.

### Moving Objects Between Folders

To move an object to a different folder:
1. Navigate to the object you want to move
2. Select **Edit** or modify the object
3. Change the **Folder** selection to the target folder
4. Save the changes

|     |     |
| --- | --- |
|  | You must have **edit** permissions on both the source and target folders to move objects between them. |

### Removing Folder Associations

To remove a folder association and move an object to the root level:
1. Edit the object
2. Clear the folder selection or select "No folder"
3. Save the changes

|     |     |
| --- | --- |
|  | Objects without folder associations are accessible based on your system’s default permissions. Check with your administrator about root-level access policies. |

## Permission System

### How Permissions Work

Folder mapping uses Grafana’s native folder permission system:

| Permission Level | Access Rights                                                       |
| ----------------| ------------------------------------------------------------------- |
| **View**        | Read-only access to objects in the folder                          |
| **Edit**        | Full access to create, modify, and delete objects in the folder    |
| **Admin**       | Full access plus ability to manage folder permissions               |

### Permission Inheritance

When you assign an object to a folder:
1. The object **inherits** the folder’s permission settings
2. Users with folder access can view/edit the object based on their permission level
3. Changes to folder permissions automatically apply to all contained objects

### Access Control Flow

The system follows this access control flow:
1. User attempts to access a logs object
2. System checks if the object has a folder mapping

## Best Practices

### Organizing Your Folder Structure
1. **Use hierarchical naming**: Create folders that reflect your team/project structure
2. **Apply consistent permissions**: Ensure similar objects have similar access patterns
3. **Document folder purposes**: Maintain clear descriptions of what each folder contains
4. **Regular permission reviews**: Periodically audit folder access to ensure it matches current needs

### Security Considerations
1. **Principle of least privilege**: Grant only the minimum permissions necessary
2. **Regular access reviews**: Monitor and update permissions as team roles change
3. **Folder naming conventions**: Use descriptive names that indicate sensitivity/scope
4. **Default permissions**: Understand your system’s default behavior for unmapped objects

## Related Documentation

- [Folder APIs](https://docs.kloudfuse.com/platform/4.0.2/administration/authorization/folder-mapping-api/) - API documentation for programmatic folder management
- [Manage Folders](https://docs.kloudfuse.com/platform/4.0.2/administration/authorization/admin-folders/) - Core folder management in Kloudfuse
- [Role-Based Access Control (RBAC)](https://docs.kloudfuse.com/platform/4.0.2/administration/authorization/rbac/) - Understanding the overall RBAC system
- [Manage Policies](https://docs.kloudfuse.com/platform/4.0.2/administration/authorization/admin-policies/) - Advanced permission configuration
- [Manage Teams](https://docs.kloudfuse.com/platform/4.0.2/administration/users-teams/admin-teams/) - Team-based access control

## Support

If you need assistance with folder mapping:
- Check your folder permissions in the Admin interface
- Contact your system administrator for feature flag or configuration issues
- Refer to the API documentation for integration questions