{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41686,"path":"platform-security/maps-for-fe.md","title":"Configure module access policies for Field Encryption","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure module access policies for Field Encryption\n\nCreate a module access policy to control which users, scripts, or system processes can encrypt or decrypt data encrypted by a field encryption module.\n\n## Before you begin\n\nRole required: security\\_admin and sn\\_kmf.cryptographic\\_manager or sn\\_kmf.admin\n\nYou must have a published field encryption module to use this process. If you have not done so, see [Configure Field Encryption modules](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/configure-fe-modules.md).\n\n## About this task\n\nModule access policies \\(MAPs\\) are the access controls you apply to your field encryption modules to define which users, scripts, or system processes can encrypt or decrypt data. Configure MAPs for users \\(via roles\\), scripts, or processes running in the “system” context. Without a MAP, users, scripts, or system processes aren’t able to encrypt or decrypt data, which can result in end-to-end workflow processes not working correctly.\n\nMAPs are separate from access control lists \\(ACL\\), but can be used in combination with them. See [Exploring Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/exploring-fe.md) for more information about the purpose behind MAPs.\n\nFor Field Encryption Enterprise, review to plan for which users, scripts, or system processes need a MAP.\n\n## Procedure\n\n1. Navigate to **All** > **System Security** > **Field Encryption** > **Field Encryption Experience**.\n\n2. Select **Access Policies** within the module's tile.\n\n3. In the Module Access Policy form, fill in the fields as needed.\n\n\n
\n\nField\n\n\n\nDescription\n\n
\n\nPolicy Name\n\n\n\nName of your MAP\n\n
\n\nType\n\n\n\nDecide who or what should have access to this MAP to encrypt or decrypt data.- **Scope**\n\nAnything within the specified Application Scope has access to this MAP.\n\n- **Role**\n\nOnly users with the specific role can access this MAP.\n\n- **Script**\n\nEnsure a specified script can access this MAP.\n\n- **System Access**\n\nAllows processes running in “System Context” access to this MAP.\n\n- **Resource Exchange**\n\nAllows for the Resource Exchange feature access to this MAP.\n\nFor more information on how these different types of MAP work, see [Exploring Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/exploring-fe.md).\n\n
\n\nResult\n\n\n\nSelect one of the following:- **Track**\n\nPermits access and monitors use of the MAP.\n\n- **Reject**\n\nRejects access unless a different MAP grants access.\n\n- **StrictReject**\n\nRejects access under all circumstances, even if a different MAP grants access.\n\n
\n\nCrypto Module\n\n\n\nSelect the field encryption module to be governed by this MAP.\n\n
\n\nCrypto Spec\n\n\n\nOptional. Select or create a new Cryptographic Specification for this MAP.This field appears only when the **Specify Purpose** field is enabled.\n\n
\n\nActive\n\n\n\nEnable to activate this MAP.\n\n
\n\nTarget Scope\n\n\n\nSelect a scope to that this MAP applies to. This field appears only if the **Type** field is set to **Scope**.\n\n
\n\nTarget Role\n\n\n\nSelect which role should have access to this MAP.This field appears only when the **Type** field is set to **Role**\n\n
\n\nTarget Script\n\n\n\nChoose the specific script of the type table selected in the **Script Table** field that should have access to this MAP.This field appears only if the **Type** field is set to **Script**.\n\n
\n\nApproval Type\n\n\n\nSelect either **One Time** or **Recurring**:- **One Time**\n\nAllows for the symmetric data encryption key in the associated field encryption module to be securely shared to the target instance one time.\n\n- **Recurring**\n\nAllows for the symmetric data encryption key in the associated field encryption module to be securely shared to the target instance on a recurring basis.\n\nThis field appears only if the **Type** field is set to **Resource Exchange**.\n\n
\n\nTarget Instance Host\n\n\n\nEnter the URL for the target instance that the symmetric data encryption key in the associated field encryption module is being sent to.This field appears only if the **Type** field is set to **Resource Exchange**.\n\n
\n\nSpecify Purpose\n\n\n\nOptional. Enable to display the **Crypto Spec** field on the form. Enable this option to configure granular operations, such as some users being able to encrypt, but not decrypt.\n\n
\n\nGranular Operation\n\n\n\nOptional. Select the cryptographic purpose for the Crypto Spec. The values available depend upon the type of Crypto Spec that is selected. For example, you can specify that this MAP only allows users to encrypt, but not decrypt, or the opposite, or both.\n\nThis field appears only if there’s a value in the **Crypto Spec** field.\n\n- If a user has encrypt access, but not decrypt access, the field displays in edit mode and the data entered displays as asterisks.\n- If a user has decrypt access, but not encrypt access, the field displays the decrypted data in read-only mode.\n- If a user has encrypt and decrypt access, both read and write functionality are available for the encrypted field.\n\n\n
\n\nScript Table\n\n\n\nSelect which type of script applies to this MAP:- Access Control\n- Activity Designer\n- Business Rule\n- Inbound Email Action\n- Record Producer\n- Scheduled Script Execution\n- Script Include\n- UI Action\n- Widget\n- Workflow Activity\nThis field appears only if the **Type** field is set to **Script**.\n\n
\n\nCheck Script Version\n\n\n\nWhen selected, the system checks the version of the script that is run with the version specified in the **Target Script** field. If the versions are different, the admin is notified.This field appears only if the **Type** field is set to **Script**.\n\n
\n\nImpersonation\n\n\n\nWhen enabled, a user impersonating another user gains any MAP permissions from both users. If disabled, a user impersonating another user only has any MAP permissions that were granted to them from before the impersonation.\n\n
4. Select **Submit**.\n\n\n**Parent Topic:**[Configuring Field Encryption](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/configuring-column-level-encryption.md)\n\n"}}