Configure customized user access roles

When predefined roles don’t align with your team’s specific needs, whether they provide too much access or not enough, create customized user access roles to define the exact scope of data a user can interact with.

Before you begin

  • You must be an account administrator or a member of a group with the RBAC Administrator role to create a role.

Procedure

  1. From Red Hat Hybrid Cloud Console, click SettingsSettings icon. User Access opens.
  2. Click the Roles tab.
  3. Click Create Role to open the Add role wizard.
  4. On the Name and Description page, define the role’s purpose by providing a clear name and description and click Next.
  5. On the Permission page, specify cost management as the Red Hat Cloud Services application you are creating the role for as well as the resource and permission type to ensure the user’s access is associated with a specific technical boundary:
    1. For Application, enter cost-management.
    2. For Resource type, specify the resource from the following list that this permission will be used to access:
      • aws.account
      • aws.organizational_unit
      • azure.subscription_guid
      • openshift.cluster
      • openshift.node
      • openshift.project
      • gcp.account
      • gcp.project
      • cost_model - Read
      • cost_model - Write
      • settings - Read
      • settings - Write Note

        When you add an AWS organizational unit as a resource type, any user who has access to the parent node also has access to all children and sub-children of the parent node.
    3. For Permission, select from the available resource types.

      For example, to create a role with read-only permissions to AWS account data, specify aws.account as the Resource type and read as the Permission. In the next step, you can specify the AWS account to apply this role to.

      For example, to grant this role access to a specific AWS account, enter the following information and click Add to definitions:

      • Key: aws.account
        • Options for Key are: aws.account, aws.organizational_unit, azure.subscription_guid, openshift.cluster, openshift.node, openshift.project, gcp.account, gcp.project, cost_model - Read, cost_model - Write, settings - Read, settings - Write
      • Operation: equal
        • Use equal if you know the exact value, or list to see a list of values that will work for this role.
      • Value: Your AWS account number or account alias.
        • This is specific to the resource defined in the Key field. Examples include the AWS account ID or alias, AWS organizational unit, Azure subscription ID, OpenShift cluster ID, OpenShift node name, or OpenShift project name.

          You can also enter * in this field as a wildcard to create a role that matches everything of the resource type defined in Key.

  6. Add more resource definitions if desired and click Next when finished.
  7. Review the details for this role and click Confirm to create the role.

    Your new role will be listed in the Roles tab on the User Access Management page.

Results

  • Verify the new role appears in the Roles tab on the User Access Management page.