Create custom User Access roles

User Access provides a number of predefined roles that you can add to groups. In addition to using the predefined roles, you can create and manage custom User Access roles with granular permissions for one or more services.

How to create and manage custom roles for specific console services
Copy link

A guided wizard leads you through the steps for adding a role. The following steps describe how to use the Create role wizard.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.

The Default access group contains a subset of all predefined roles. For a list of all predefined roles provided by Red Hat, see section Predefined User Access roles.

Note
You cannot modify a predefined role.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Roles. The Roles window appears.
  2. Click the Create role button. This starts the Create role wizard.
  3. At this point in the wizard, you can create a role from scratch or copy an existing role.

About granular permissions
Copy link

Granular permissions allow an Organization Administrator to define role permissions for one or more applications. Many of the predefined roles provide wildcard permissions, which is equivalent to a super user role with full access to all actions.

By defining granular permissions, you can create (or modify) roles with limited permissions, such as read-only, or read and update but not delete.

As an example, compare the predefined roles of Cost Administrator and Cost Price List Viewer.

Role Application Resource Operation

Cost Administrator

cost-management

* (all)

* (all)

Cost Price List Viewer

cost-management

cost_model

read

By creating a new role, you can define the applications, resources, and operations that are specific to that role.

Copy an existing role
Copy link

Copy an existing role when that role already contains many of the permissions you want to use and you need to change, add, or remove some permissions.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • You started the Create role wizard.

An existing role can be one of the predefined roles provided by Red Hat or it can be a previously created custom role.

For a list of predefined roles provided by Red Hat, see section Predefined User Access roles.

Note
You cannot modify a predefined role.

Procedure
Copy link

  1. In the Create role wizard, click the Copy an existing role button.
  2. Click the button next to the role you want to copy.
  3. Click the Next button.
  4. The Name and description window shows a copy of the Role name and the existing Role description filled in. Make changes as needed.
  5. Click the Next button. If the role name already exists, you must provide a different name before you can proceed.
  6. Use the Add permissions window to select the application permissions to include in your role. By default, permissions are listed by application.
    Tip
    Custom roles only support granular permissions. Wildcard permissions, such as approval:*:* are not copied into a custom role.
  7. Optionally use the filter drop-down to to filter by Applications, Resources, or Operations.
    Tip
    Use the list at the top of the wizard page to view all the permissions added to the role. You can click a permission to delete it.
  8. Click the Next button to review details. You can click the Submit button to submit the role, the Back button to go back and make changes, or the Cancel button to cancel the action.

Results
Copy link

The role you created is available to add to a User Access group.

Create a role from scratch
Copy link

Create a role from scratch when you want to create a role with specific granular permissions.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • You started the Create role wizard.

Procedure
Copy link

  1. In the Create role wizard, click the Create a role from scratch button.
  2. Enter a Role name, which is required.
  3. Optionally, enter a Role description.
  4. Click the Next button. If the role name already exists, you must provide a different name before you can proceed.
  5. Use the Add permissions window to select the application permissions to include in your role. By default, permissions are listed by application.
  6. Optionally use the filter drop-down to to filter by Applications, Resources, or Operations.
    Tip
    Use the list at the top of the wizard page to view all the permissions added to the role. You can click a permission to delete it.
  7. Click the Next button to review details. You can click the Submit button to submit the role, the Back button to go back and make changes, or the Cancel button to cancel the action.

    The role you created is available to add to a User Access group.

Edit custom role names
Copy link

You can change the name of a custom role from the main roles page or from the Permissions page.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • One or more custom role must exist.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Roles. The Roles window appears. In the Roles window, a custom role has a more options icon (⋮) to the right of its name.
  2. Click the more options icon (⋮).
  3. Click on Edit to change the role name or description.
  4. Click on Delete to remove the custom role.
    Tip
    You can also click on the role name to open the Permissions window and then click on the more options icon (⋮) to the right of the role name to access the Edit and Delete actions.
  5. A confirmation window appears. After you confirm that this action cannot be undone, the custom role is deleted.

Remove permissions from a custom role
Copy link

You can remove permissions from a custom role in the Red Hat Hybrid Cloud Console.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • One or more custom role must exist.

Procedure
Copy link

  1. Navigate to the Red Hat Hybrid Cloud Console > Settings > Identity & Access Management > User Access > Roles. The Roles window appears. In the Roles window, a custom role has a more options icon (⋮) to the right of its name.
  2. Click on a custom role name to open the Permissions window.
  3. In the Permissions list, click the more options icon (⋮) to the right of an application permission name and click Remove.
  4. A confirmation window appears. Click Remove permission.

Create cost management service roles
Copy link

You can create a role that is specific to the cost management service. When you create a cost management role, you define cost management resource definitions for that role. Other service roles do not provide that choice.

Before you begin
Copy link

  • Cost management operator is installed and configured. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • A minimum of one cloud integration is configured for cost management.
  • You started the Create role wizard.

This procedure describes how to create roles with cost management permissions from scratch.

Procedure
Copy link

  1. In the Create role window, click on the radio button Create a role from scratch.
  2. Enter a Role name (required) and a Role description (optional).
  3. Click the Next button to display the Add permissions window.
  4. Enter cost in the Filter by application field to display the cost management service and click on the cost-management check box.
  5. When the Add permissions window appears, click on the check box for each cost management permission to include in this role.
  6. Click on the Next button to display the Define Cost Management resources window.
  7. You will see a drop-down list of available Resource definitions for each service permission you added to the role. You must click on the check box for at least one resource in each cost management permission.
  8. Click the Next button to review details. You can click the Submit button to submit the role, the Back button to go back and make changes, or the Cancel button to cancel the action.

Example: Create a cost management role from scratch
Copy link

You can create a role from scratch in the Red Hat Hybrid Cloud Console.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as a user who has Organization Administrator permission. Note
    You cannot log in to the Hybrid Cloud Console with your email address unless your email address is the same as your Red Hat login. For more information, see Find your Red Hat login.
  • If you are not an Organization Administrator, you must be a member of a group that has the User Access administrator role assigned to it.
  • A minimum of one cloud integration is configured for cost management.
  • You started the Create role wizard.

Procedure
Copy link

  1. Start the Create role wizard and click on Create a role from scratch.
  2. Enter AWS Org Unit Cost Viewer for Role name and then click the Submit button. A description is not required.
  3. Enter cost in the Filter by application field to display the cost management application and click on the cost-management check box.
  4. Click the check box on the line that contains aws.organizational_unit and then click the Next button to display a drop-down list of available Resource definitions for the permission.
  5. Click on the check box for at least one resource listed in the Resource definitions list and then click the Next button to review details.
  6. After you review the details for this role, which show the Permissions and Resource definitions, click the Submit button to submit the role.

Example: Create a group for a service account
Copy link

The Organization Administrator can create a new User Access group with roles or permissions that are specific to a service account. This group has the permissions that allow a service account to access services and applications on the Red Hat Hybrid Cloud Console.

Before you begin
Copy link

  • You are logged in to the Red Hat Hybrid Cloud Console as the Organization Administrator or as a user with User Access administrator permissions.
  • One or more service accounts are associated with your Red Hat organization account. See Create a service account and generate credentials.
  • You have access to the Client Secret information for the service account that you add to the User Access group. Note
    The Client Secret information is displayed once when you create a new service account. You must copy and save that information. It is not displayed again.

In this example, you create a group that allows a service account to view automation analytics on the Red Hat Ansible Automation Platform.

Note
Any user can create a service account but only the Organization Administrator or a User Access administrator can add or create a new group for a service account.

Procedure
Copy link

  1. From the Red Hat Hybrid Cloud Console, click the Settings menu and click User Access.
  2. Click the Groups tab and click Create Group.
  3. Add a Group name and a Group description. The description is optional.
  4. Click Next to add roles to the group. For this example, find Automation Analytics viewer and click the checkbox next to the role name.
  5. Click Next to display Add members. Because you are adding a service account and not a member, click Next. Add service accounts appears.
  6. Choose the service account you want to add and click the checkbox next to the name.
  7. Click Next, review the details and if no changes are needed, click Submit. The new group is created that contains the service account and the Automation Analytics viewer role and permissions.