Skip to main content

Permission Policies

Permission Policies

The three basic permission roles (Read, ReadWrite, Admin) are all-or-nothing across the whole system. A permission policy lets you build something more targeted — for example, a user who can create and edit volumes but never delete them, or a user who can only view (never change) snapshot schedules. Create the policy once, then assign it to one or more users in place of a basic role.

A policy is built from three layers, applied together:

  • Allowed operation types — which kinds of actions are permitted: Get (view), Create, Edit, Delete.
  • Allowed entity types — which kinds of resources those actions apply to (applications, volumes, snapshots, users, and so on). Leave this unset to apply the allowed operations broadly.
  • Additional / blocked commands — explicit exceptions layered on top, for the rare cases where a specific command needs to be allowed or denied outside the operation/entity rule above.

Creating a permission policy

Using the web interface

  1. Open Administration > Users, then switch to the Permission Policies view.
  2. Click Create.
  3. Under Policy Name, enter the policy's Name.
  4. Under Entity and Operation Types, choose the Allowed Operation Types (Get/Create/Edit/Delete) and, optionally, the Allowed Entity Types the policy applies to.
  5. Under Add/Remove Specific Commands, optionally add Additional Commands to explicitly allow, or Blocked Commands to explicitly deny, regardless of the rules above.
  6. Confirm to create the policy.

Using the CLI

users permission_policy create <name> --allowedOperationTypes=<name...> [--allowedEntityTypes=<name...>] [--additionalCommands=<name...>] [--blockedCommands=<name...>]
Option Description
<name> The name of the permission policy.
--allowedOperationTypes=<name...> Allowed operations on the specified entity types: Get, Create, Edit, Delete.
--allowedEntityTypes=<name...> The entity types this policy manages.
--additionalCommands=<name...> Explicitly allow these additional commands.
--blockedCommands=<name...> Explicitly blocked commands.

Examples

Create a policy that can view and modify volumes and applications, but never delete them:

users permission_policy create volume-editors --allowedOperationTypes Get,Create,Edit --allowedEntityTypes Applications,Volumes

Create a read-only policy across the whole system, with one explicit exception allowing the user to also run snapshot creation:

users permission_policy create read-only-plus-snapshots --allowedOperationTypes Get --additionalCommands "applications volumes snapshots create"

Editing a permission policy

Editing a policy replaces its entity/operation rules and command exceptions with the new values you provide — it isn't a partial update, so include everything the policy should end up with.

Using the web interface

  1. Open Administration > Users, then switch to the Permission Policies view.
  2. Select the policy and click Edit.
  3. Update the Name, Allowed Operation Types/Allowed Entity Types, and Additional Commands/Blocked Commands as needed.
  4. Confirm the change.

Using the CLI

users permission_policy edit <name> [--newName=<name>] [--allowedOperationTypes=<name...> --allowedEntityTypes=<name...>] [--additionalCommands=<name...>] [--blockedCommands=<name...>] [--force]
Option Description
<name> The name of the permission policy to modify.
--newName=<name> The new name for the permission policy.
--allowedOperationTypes=<name...> Allowed operations on the specified entity types.
--allowedEntityTypes=<name...> The entity types this policy manages.
--additionalCommands=<name...> Explicitly allow these additional commands.
--blockedCommands=<name...> Explicitly blocked commands.
--force Skip the confirmation prompt. Editing resets all of the policy's previous settings to the new values.

Example

Rename the policy and tighten it to view-only:

users permission_policy edit volume-editors --newName volume-viewers --allowedOperationTypes Get --allowedEntityTypes Applications,Volumes

Listing permission policies

Using the web interface

Open Administration > Users, then switch to the Permission Policies view. Use the toolbar to filter and to show the commands each policy exposes.

Using the CLI

users permission_policy list [<name> --operationTypes=<name...> --entityTypes=<name...> --commands=<name...> --showCommands]
Option Description
<name> Filter by permission policy name.
--operationTypes=<name...> Filter by allowed operation types.
--entityTypes=<name...> Filter by managed entity type.
--commands=<name...> Filter by specific allowed commands.
--showCommands Show the allowed commands for the policies.

Examples

List every policy:

users permission_policy list

Show exactly which commands the volume-editors policy exposes:

users permission_policy list volume-editors --showCommands

Deleting a permission policy

A policy can't be deleted while it's still assigned to any user — remove it from all users first.

Using the web interface

  1. Open Administration > Users, then switch to the Permission Policies view.
  2. Select the policy and click Delete.
  3. Confirm the deletion.

Using the CLI

users permission_policy delete <name> [--force]
Option Description
<name> The name of the permission policy to delete.
--force Skip the confirmation prompt.

Example

users permission_policy delete volume-viewers --force

See also: Users — creating and managing user accounts.