Skip to main content

Role reference

A role is a set of permitted operations on specific types of resources.

Roles are assigned within permissions. A role applies to the scope specified in the permission; learn more in the Access management in Servercore products instructions.

Some roles can be assigned only in a specific access scope, and may also have a different set of manageable resources across different access scopes.

Depending on the resources and settings they grant access to, roles are divided into:

  • into global roles: define access to resources of all products in the selected scope (except for products that do not support access management), as well as to account, billing, and access settings;
  • and product roles: determine access to resources of one or more products in the selected access scope. They do not allow managing other products, or account, billing, and access settings.

Full access to manage the account and resources, as well as exclusive permissions, belongs to the Account Owner — the user who registered the account. The Account Owner status is not a role and cannot be changed or assigned to anyone.

Role list

Role groupRole listWhat it manages
Global rolesmemberAll products, account, billing, projects
billingBilling
iam.adminAccess settings
iam.viewerView access settings only
readerAll products, account, billing, projects (view only)
audit_logsaudit_logs.adminAudit logs
certificatesSecrets Manager
compute
  • cloud servers and flavors;
  • cloud server placement groups;
  • cloud server network volumes and snapshots;
  • cloud server images;
  • backups of cloud server network volumes
dedicated
  • dedicated servers;
  • colocated equipment;
  • firewalls;
  • basic firewall;
  • data storage system;
  • network drives for dedicated servers;
  • leased network equipment
filestorageFile Storage
global_routerGlobal Router
go1cPre-configured 1C Cloud
logsLogs
metricsmetrics.adminMetrics
mobile_farmMobile Farm
secretsSecrets Manager
s3, data_migration and object_storageS3
vpc
  • Cloud Platform networks;
  • cloud firewalls;
  • security groups;
  • cloud load balancers;
  • private DNS

Global roles

member

The member role grants full access to manage all products and resources. It does not grant access to manage users, service users, user groups, or federations.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • manage projects, their limits, and quotas;
  • manage billing;
  • manage resources across all projects;
  • manage resources outside of projects;
  • work with audit logs

In the Project access scope:

  • manage resources of the selected project

billing

The billing role grants access to billing management without access to service management.

Access scopesAccount
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

  • manage billing:

    • top up balance and transfer funds between balances;
    • manage auto-invoicing, monthly payments, and deferred payments;
    • manage balance notifications;
    • manage bank cards;
    • view reporting documents;
    • manage affiliate program and payouts;

  • view enabled services and service statuses

iam.admin

The iam.admin role grants access to user management without access to services and billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the iam.admin role can only be created by the Account Owner.

Access scopesAccount
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations
  • manage users, service users, and user groups;
  • manage federations;
  • issue keys to users;
  • manage notifications of other users;
  • configure account access restrictions

iam.viewer

The iam.viewer role grants access to view everything managed by iam.admin.

Access scopesAccount
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations
  • view users, service users, and user groups;
  • view federations;
  • view user keys;
  • view notifications of other users;
  • view account access restrictions

reader

The reader role grants access to view everything managed by member within the same access scope.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view resources across all projects, as well as resources not assigned to a project;
  • view settings of all projects, their limits, and quotas;
  • view billing data (balance, bank cards, reporting documents, affiliate program, etc.)

In the Project access scope:

  • view resources of the selected project

audit_logs roles

audit_logs.admin

The audit_logs.admin role grants access to audit logs; learn more in the instructions Manage access to audit logs.

Access scopes

Account

Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

Export audit logs

certificates roles

certificates.admin

The certificates.admin role grants access to manage certificates in Certificate Manager; learn more in the instructions Manage access to Certificate Manager.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • manage custom certificates (add, update, delete) across all projects;
  • manage Let’s Encrypt® certificates (issue, download, delete) across all projects;
  • manage certificate consumers across all projects;
  • view public and private parts of certificates across all projects

In the Project access scope:

  • manage custom certificates (add, update, delete) in their project;
  • manage Let’s Encrypt® certificates (issue, download, delete) in their project;
  • manage certificate consumers (add, delete) in their project;
  • view public and private parts of certificates in their project

certificates.viewer

The certificates.viewer role grants access to view everything managed by certificates.admin; learn more in the instructions Manage access to Certificate Manager.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of custom certificates and their information across all projects;
  • view the list of Let’s Encrypt® certificates and their information across all projects;
  • view certificate consumers across all projects;
  • view public parts of certificates across all projects

In the Project access scope:

  • view the list of custom certificates and their information in their project;
  • view the list of Let’s Encrypt® certificates and their information in their project;
  • view certificate consumers in their project;
  • view public parts of certificates in their project

certificates.consumer

The certificates.consumer role grants access to view and use certificates in Certificate Manager; learn more in the instructions Manage access to Certificate Manager.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of custom certificates and their information across all projects;
  • view the list of Let’s Encrypt® certificates and their information across all projects;
  • manage certificate consumers across all projects;
  • view public and private parts of certificates across all projects

In the Project access scope:

  • view the list of custom certificates and their information in their project;
  • view the list of Let’s Encrypt® certificates and their information in their project;
  • manage certificate consumers in their project;
  • view public and private parts of certificates in their project

compute roles

compute.admin

The compute.admin role grants access to manage:

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas, modified quota values, and used quotas);
  • manage cloud servers (create, modify, delete) * across all projects;
  • use console;
  • manage flavors (create, modify, delete) across all projects;
  • manage SSH keys (add, delete) across all projects;
  • manage placement groups (create, delete) across all projects

In the Project access scope:

  • view project quotas (default quotas, modified quota values, and used quotas);
  • manage cloud servers (create, modify, delete) * in their project;
  • use console;
  • manage flavors (create private flavors, modify, delete) in their project;
  • manage SSH keys (add, delete) in their project;
  • manage placement groups (create, delete) in their project

* To manage cloud servers, an additional role with access to manage Cloud Platform networks is required.

compute.viewer

The compute.viewer role grants access to view everything managed by compute.admin.

Access scopes
  • account;
  • project
Assignable to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas, modified quota values, and used quotas);
  • view the list of cloud servers and their information (server type, configuration type, number of vCPUs, memory size, attached volumes, security groups, network settings, tags) across all projects;
  • view statistics for cloud servers across all projects;
  • view the list of flavors and their information (flavor name, number of vCPUs, RAM, and local disk size) across all projects;
  • view the list of SSH keys and their information across all projects;
  • view the list of placement groups and their information (group name, placement policy condition) across all projects

In the Project access scope:

  • view project quotas (default quotas, modified quota values, and used quotas);
  • view the list of cloud servers and their information (server type, configuration type, number of vCPUs, memory size, attached volumes, security groups, network settings, tags) in their project;
  • view statistics for cloud servers in their project;
  • view the list of flavors and their information (flavor name, number of vCPUs, RAM, and local disk size) in their project;
  • view the list of SSH keys and their information in their project;
  • view the list of placement groups and their information (group name, placement policy condition) in their project

compute.server.user

The compute.server.user role grants access to manage cloud servers; learn more in the instructions Manage access to cloud servers and flavors.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas, modified quota values, and used quotas);
  • manage cloud servers (create, modify) * across all projects;
  • use console;
  • view the list of flavors and their information across all projects: flavor name, number of vCPUs, RAM, and local disk size across all projects;
  • manage SSH keys (add, delete) across all projects

In the Project access scope:

  • view project quotas (default quotas, modified quota values, and used quotas);
  • manage cloud servers (create, modify) * in their project;
  • use console;
  • view the list of flavors and their information in their project: flavor name, number of vCPUs, RAM, and local disk size;
  • manage SSH keys (add, delete) in their project

* To manage cloud servers, an additional role with access to manage Cloud Platform networks, network volumes, images, and backups is required.

compute.server.viewer

The compute.server.viewer role grants access to view everything managed by compute.server.user.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas, modified quota values, and used quotas);
  • view the list of cloud servers and their information across all projects: server type, configuration type, number of vCPUs, memory size, attached volumes, security groups, network settings, tags;
  • view statistics for cloud servers across all projects;
  • view the list of flavors and their information across all projects: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information across all projects

In the Project access scope:

  • view project quotas (default quotas, modified quota values, and used quotas);
  • view the list of cloud servers and their information in their project: server type, configuration type, number of vCPUs, memory size, attached volumes, security groups, network settings, tags;
  • view statistics for cloud servers in their project;
  • view the list of flavors and their information in their project: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information in their project

compute.flavor.admin

The compute.flavor.admin role grants access to manage cloud server flavors; learn more in the instructions Manage access to cloud servers and flavors.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas) across all projects;
  • manage flavors (create private flavors, modify, delete) across all projects;
  • view the list of SSH keys and their information across all projects

In the Project access scope:

  • view project quotas (default quotas) in their project;
  • manage flavors (create private flavors, modify, delete) in their project;
  • view the list of SSH keys and their information in their project

compute.flavor.viewer

The compute.flavor.viewer role grants access to view everything managed by compute.flavor.admin.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas);
  • view the list of flavors and their information across all projects: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information across all projects

In the Project access scope:

  • view project quotas (default quotas);
  • view the list of flavors and their information in their project: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information in their project

compute.server_group.admin

The compute.server_group.admin role grants access to manage cloud server placement groups; learn more in the instructions Manage access to cloud server placement groups.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view quotas of all projects (default quotas);
  • manage placement groups (create, delete) across all projects;
  • view the list of flavors and their information across all projects: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information across all projects

In the Project access scope:

  • view project quotas (default quotas) in their project;
  • manage placement groups (create, delete) in their project;
  • view the list of flavors and their information in their project: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information in their project

compute.server_group.viewer

The compute.server_group.viewer role grants access to view everything managed by compute.server_group.admin.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • retrieve quotas of all projects;
  • view the list of placement groups and their information across all projects: group name, placement policy condition;
  • view the list of flavors and their information across all projects: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information across all projects

In the Project access scope:

  • retrieve project quotas;
  • view the list of placement groups and their information in their project: group name, placement policy condition;
  • view the list of flavors and their information in their project: flavor name, number of vCPUs, RAM, and local disk size;
  • view the list of SSH keys and their information in their project

compute.volume.admin

The compute.volume.admin role grants access to manage cloud server network volumes; learn more in the instructions Manage access to cloud server network volumes and snapshots.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of all network volumes and their information across all projects: volume type, volume size;
  • manage volumes (create, modify, delete) across all projects;
  • transfer volumes between projects;
  • view volume transfer information across all projects

In the Project access scope:

  • view the list of all network volumes and their information in their project: volume type, volume size;
  • manage volumes (create, modify, delete) in their project;
  • transfer volumes from their project to another;
  • view volume transfer information in their project

compute.volume.user

The compute.volume.user role grants access to manage cloud server network volumes; learn more in the instructions Manage access to cloud server network volumes and snapshots.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of all network volumes and their information (volume type, volume size) across all projects;
  • manage volumes (create, modify, delete) across all projects

In the Project access scope:

  • view the list of all network volumes and their information (volume type, volume size) in their project;
  • manage volumes (create, modify, delete) in their project

compute.volume.viewer

The compute.volume.viewer role grants access to view everything managed by compute.volume.user.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of network volumes and their information (volume type, volume size) across all projects

In the Project access scope:

  • view the list of network volumes and their information (volume type, volume size) in their project

compute.snapshot.admin

The compute.snapshot.admin role grants access to manage network volume snapshots; learn more in the instructions Manage access to cloud server network volumes and snapshots.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of snapshots and their information (snapshot size, creation date, and status) across all projects;
  • manage snapshots (create, delete) across all projects

In the Project access scope:

  • view the list of snapshots and their information (snapshot size, creation date, and status) in their project;
  • manage snapshots (create, delete) in their project

compute.snapshot.viewer

The compute.snapshot.viewer role grants access to view everything managed by compute.snapshot.admin.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of snapshots and their information (snapshot size, creation date, and status) across all projects

In the Project access scope:

  • view the list of snapshots and their information (snapshot size, creation date, and status) in their project

compute.image.admin

The compute.image.admin role grants access to manage images and configure image sharing; learn more in the instructions Manage access to cloud server images.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of images and their information across all projects: image size, image and container format, minimum image requirements;
  • manage images (upload, create, modify, delete) across all projects;
  • configure image sharing across projects within the same account or from other accounts

In the Project access scope:

  • view the list of images and their information in their project: image size, image and container format, minimum image requirements;
  • manage images (upload, create, modify, delete) in their project;
  • configure image sharing across projects within the same account or from other accounts

compute.image.user

The compute.image.user role grants access to manage images; learn more in the instructions Manage access to cloud server images.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of images and their information across all projects: image size, image and container format, minimum image requirements;
  • manage images (upload, create, modify, delete) across all projects

In the Project access scope:

  • view the list of images and their information in their project: image size, image and container format, minimum image requirements;
  • manage images (upload, create, modify, delete) in their project

compute.backup.admin

The compute.backup.admin role grants access to manage network volume backups and backup plans; learn more in the instructions Manage access to cloud server network volume backups.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of backups and their information (backup type, size, attached backup plans, status) across all projects;
  • manage backups (create, delete) across all projects;
  • view the list of backup plans across all projects;
  • manage backup plans (create, modify, delete) across all projects

In the Project access scope:

  • view the list of backups and their information (backup type, size, attached backup plans, status) in their project;
  • manage backups (create, delete) in their project;
  • view the list of all backup plans in their project;
  • manage backup plans (create, modify, delete) in their project

compute.backup.viewer

The compute.backup.viewer role grants access to view everything managed by compute.backup.admin.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of backups and their information (backup type, size, attached backup plans, status) across all projects;
  • view the list of backup plans across all projects

In the Project access scope:

  • view the list of backups and their information (backup type, size, attached backup plans, status) in their project;
  • view the list of backup plans in their project

dedicated roles

dedicated.admin

The dedicated.admin role grants access to manage:

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of projects;
  • manage dedicated servers (order, modify, cancel) across all projects;
  • manage colocated equipment (order, modify, cancel) across all projects;
  • manage networks;
  • enable and disable additional services;
  • view the list of SSH keys, add SSH keys to storage, and manage added SSH keys;
  • manage firewalls (order, modify, cancel);
  • manage network drives (create, modify, delete);
  • manage storage systems (order, modify, cancel);
  • manage basic firewall (create, modify, delete);
  • manage leased hardware (order, modify, cancel)

In the Project access scope:

  • manage dedicated servers (order, modify, cancel) in their project;

  • manage colocated equipment (order, modify, cancel) in their project;

  • enable and disable additional services;

  • view the list of SSH keys added to storage and their information;

  • viewing and management are not available for:

    • networks;
    • firewalls;
    • network drives and storage systems;
    • basic firewall;
    • leased network hardware

dedicated.viewer

User with access to view everything managed by dedicated.admin within the same access scope.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • view the list of all dedicated servers and their information across all projects;
  • view the list of colocated equipment and its information across all projects;
  • view the list of all VLANs, public and private subnets, SAN networks, and their information;
  • view the list of network drives and storage systems and their information;
  • view the list of firewalls and their information;
  • view the list of basic firewalls and their information;
  • view the list of leased network hardware and its information;
  • view the list of SSH keys added to storage and their information

In the Project access scope:

  • view the list of dedicated servers and their information in their project;

  • view the list of colocated equipment and its information in their project;

  • view the list of SSH keys added to storage and their information;

  • viewing and management are not available for:

    • networks;
    • network drives and storage systems;
    • firewalls;
    • basic firewall;
    • leased network hardware

filestorage roles

filestorage.admin

The filestorage.admin role grants access to managing file storage, for details see Manage access to file storage.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of file storages and information about them in all projects: name, size, storage type and protocol, IP and network name, status;
  • viewing access rules for file storages in all projects;
  • creating and managing file storages * in all projects;
  • creating and managing access rules in all projects

In the Project access scope:

  • viewing the list of file storages and information about them in their project: name, size, storage type and protocol, IP and network name, status;
  • viewing access rules for file storages in their project;
  • creating and managing file storages * in their project;
  • creating and managing access rules in their project

* To work with file storage, you additionally need a role with access to managing cloud platform networks to connect the file storage network.

filestorage.viewer

The filestorage.viewer role grants access to viewing everything managed by filestorage.admin.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of file storages and information about them in all projects: name, size, storage type and protocol, IP and network name, status;
  • viewing access rules for file storages in all projects

In the Project access scope:

  • viewing the list of file storages and information about them in their project: name, size, storage type and protocol, IP and network name, status;
  • viewing access rules for file storages in their project

global_router roles

global_router.admin

The global_router.admin role grants access to managing global routers in the account, for details see Manage access to global router.

Access scopesAccount
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations
  • viewing the list of global routers, networks and subnets connected to them, and the list of static routes on the router;
  • managing global routers (creation, modification, deletion);
  • adding, modifying, and deleting static routes on a global router;
  • modifying names of networks and subnets connected to a global router;
  • connecting an existing or new cloud platform network and subnet to a global router *;
  • connecting an existing or new dedicated server network and subnet to a global router *;
  • disconnecting a cloud platform network or subnet from a global router network, including deleting the cloud platform network or subnet itself *;
  • disconnecting a dedicated server network or subnet from a global router network *

* To manage connecting networks to a global router, you additionally need the member role in the Project or Account access scope.

global_router.viewer

The global_router.viewer role grants access to viewing everything managed by global_router.admin.

Access scopesAccount
Can be assigned to
  • users;
  • service users;
  • user groups
Available operationsViewing the list of global routers, networks and subnets connected to them, and the list of static routes on the router

go1c roles

go1c.admin

The go1c.admin role grants access to managing Managed 1C Cloud resources, for details see Manage access to Managed 1C Cloud.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • managing 1C server clusters in all projects * **;
  • managing infobases in all projects *;
  • managing databases in all projects;
  • managing backups in all projects *;
  • managing Prometheus tokens for metric collection in all projects

In the Project access scope:

  • managing 1C server clusters in their project * **;
  • managing infobases in their project;
  • managing databases in their project *;
  • managing backups in their project *;
  • managing Prometheus tokens for metric collection in their project

* To manage connecting backup storage, cluster data storage, and uploading an infobase from a .dt file, you additionally need a combination of roles s3.admin and iam.admin.

** To manage connecting a cluster to a private network already created in the project, you additionally need the vpc.private_network.viewer role.

go1c.viewer

The go1c.viewer role grants access to viewing everything managed by go1c.admin, for details see Manage access to Managed 1C Cloud.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing 1C server clusters in all projects;
  • viewing infobases in all projects;
  • viewing databases in all projects;
  • viewing backups in all projects;
  • viewing the list of generated Prometheus tokens for metric collection in all projects

In the Project access scope:

  • viewing 1C server clusters in their project;
  • viewing infobases in their project;
  • viewing databases in their project;
  • viewing backups in their project;
  • viewing the list of generated Prometheus tokens for metric collection in their project

logs roles

logs.admin

The logs.admin role grants access to managing logs, for details see Manage access to logs.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing logs in the control panel and using available tools in all projects;
  • managing custom logs in all projects;
  • managing log groups and event streams in all projects

In the Project access scope:

  • viewing logs in the control panel and using available tools in their project;
  • managing custom logs in their project;
  • managing log groups and event streams in their project

logs.writer

The logs.writer role grants access to adding logs to the Logs service, for details see Manage access to logs.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • adding logs from custom storage using available tools in all projects;
  • creating log groups and event streams in all projects

In the Project access scope:

  • adding logs from custom storage using available tools in their project;
  • creating log groups and event streams in their project

logs.viewer

The logs.viewer role grants access to viewing logs, for details see Manage access to logs.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing logs in the control panel and using available tools in all projects

In the Project access scope:

  • viewing logs in the control panel and using available tools in their project

metrics roles

metrics.admin

The metrics.admin role grants access to managing metrics, for details see Manage access to metrics.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • collecting metrics in all projects

In the Project access scope:

  • collecting metrics in their project

mobile_farm roles

mobile_farm.admin

The mobile_farm.admin role grants access to managing the mobile farm in their project, for details see Manage access to the mobile farm.

Access scopesProject
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations
  • viewing mobile farm consumption in their project;
  • adding and removing mobile farm devices in their project;
  • using mobile farm devices in their project;
  • changing billing plan for mobile farm devices in their project;
  • adding ADB and Proxy keys to their profile;
  • modifying mobile farm firewall rules

mobile_farm.user

The mobile_farm.user role grants access to using mobile farm devices in their project, for details see Manage access to the mobile farm.

Access scopesProject
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations
  • viewing mobile farm consumption in their project;
  • using mobile farm devices in their project;
  • adding ADB and Proxy keys to their profile;
  • viewing mobile farm firewall rules

mobile_farm.viewer

The mobile_farm.viewer role grants access to viewing everything managed by mobile_farm.admin.

Access scopesProject
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations
  • viewing mobile farm consumption in their project;
  • viewing mobile farm devices in their project;
  • adding ADB and Proxy keys to their profile;
  • viewing mobile farm firewall rules

secrets roles

secrets.admin

The secrets.admin role grants access to managing secrets in Secrets Manager, for details see Manage access to Secrets Manager.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • managing secrets (adding, deleting) in all projects;
  • managing secret versions (adding, changing current version, deleting) in all projects;
  • viewing secret contents in all projects

In the Project access scope:

  • managing secrets (adding, deleting) in their project;
  • managing secret versions (adding, changing current version, deleting) in their project;
  • viewing secret contents in their project

secrets.viewer

The secrets.viewer role grants access to viewing everything managed by secrets.admin, for details see Manage access to Secrets Manager.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of secrets and information about them, except for secret contents, in all projects

In the Project access scope:

  • viewing the list of secrets and information about them, except for secret contents, in their project

secrets.consumer

The secrets.consumer role grants access to viewing and using secrets in Secrets Manager, for details see Manage access to Secrets Manager.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of secrets and information about them in all projects;
  • viewing secret contents in all projects

In the Project access scope:

  • viewing the list of secrets and information about them in their project;
  • viewing secret contents in their project

s3, data_migration, and object_storage roles

s3.admin

The s3.admin role grants access to managing S3 within a project, for details see Manage access to S3.

Access scopesProject
Can be assigned toService users
Available operations
  • viewing the list of buckets in their project;
  • viewing bucket contents in their project;
  • managing bucket objects (uploading, modifying, deleting) in their project;
  • modifying bucket settings in their project;
  • configuring bucket access policy in their project

s3.user

The s3.user role grants access to viewing the list of buckets in the project and managing an S3 bucket if an access policy that allows access to the bucket for this user is configured for the bucket, for details see Manage access to S3. The degree of access to the bucket is defined by the access policy settings. If no access policy is created, the user has no access to the bucket.

Differs from a user with the s3.bucket.user role only in having access to viewing the list of buckets in the project.

Access scopesProject
Can be assigned toService users
Available operations
  • viewing the list of buckets in their project;
  • operations in a specific bucket that are permitted by its access policy

s3.bucket.user

The s3.bucket.user role grants access to an S3 bucket if an access policy that allows access to the bucket for this user is configured for the bucket, for details see Manage access to S3. The degree of access to the bucket is defined by the access policy settings. If no access policy is created, the user has no access to the bucket.

Differs from a user with the s3.user role only in not having access to viewing the list of buckets in the project.

Access scopesProject
Can be assigned toService users
Available operationsOperations in a specific bucket that are permitted by its access policy

data_migration.admin

The data_migration.admin role grants access to managing migrations in S3, for details see Manage access to S3.

Access scopes
  • account;
  • project
Can be assigned to
  • control panel users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • managing migrations (creating, modifying, deleting) in all projects;
  • viewing the list of migrations and information about each migration in all projects;
  • checking connections to source buckets and destination buckets in all projects;
  • managing migration execution (starting, stopping) in all projects

In the Project access scope:

  • managing migrations (creating, modifying, deleting) in their project;
  • viewing the list of migrations and information about each migration in their project;
  • checking connections to source buckets and destination buckets in their project;
  • managing migration execution (starting, stopping) in their project

data_migration.user

The data_migration.user role grants access to viewing created migrations in S3 and managing their execution, for details see Manage access to S3.

Access scopes
  • account;
  • project
Can be assigned to
  • control panel users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of migrations and information about each migration in all projects;
  • checking connections to source buckets and destination buckets in all projects;
  • managing migration execution (starting, stopping) in all projects

In the Project access scope:

  • viewing the list of migrations and information about each migration in their project;
  • checking connections to source buckets and destination buckets in their project;
  • managing migration execution (starting, stopping) in their project

data_migration.viewer

The data_migration.viewer role grants access to viewing everything managed by data_migration.admin, for details see Manage access to S3.

Access scopes
  • account;
  • project
Can be assigned to
  • control panel users;
  • service users;
  • user groups
Available operations in S3

In the Account access scope:

  • viewing the list of migrations and information about each migration in all projects

In the Project access scope:

  • viewing the list of migrations and information about each migration in their project

object_storage:admin

For your information

The object_storage:admin role will soon be removed and cannot be assigned to new users. Existing users with the object_storage:admin role continue to work.

A legacy version of the s3.admin role. Has identical permissions.

object_storage_user

For your information

The object_storage_user role will soon be removed and cannot be assigned to new users. Existing users with the object_storage_user role continue to work.

A legacy version of the s3.user role. Has identical permissions.

vpc roles

vpc.admin

The vpc.admin role grants access to managing:

Adding ports to a cloud server and deleting ports added to a cloud server is not available; this requires the compute.admin or compute.server.user role.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of:

    • all cloud platform network resources and information about them in all projects;
    • all load balancer objects and information about them in all projects: load balancers, rules and HTTP policies, target groups and servers in them, health checks;
    • cloud firewalls and information about them in all projects;
    • security groups and information about them in all projects;

  • managing private networks, subnets, and ports in all projects *;

  • managing public subnets, direct public IP addresses, and public floating IP addresses in all projects;

  • managing cloud routers in all projects;

  • managing load balancers, rules and HTTP policies, target groups, health checks, load balancer logging in all projects, as well as viewing load balancer statistics in all projects;

  • managing cloud firewalls in all projects;

  • managing security groups, rules, and ports in all projects, as well as downloading a security group report in all projects

In the Project access scope:

  • viewing the list of:

    • all cloud platform network resources and information about them in their project;
    • all load balancer objects and information about them in their project: load balancers, rules and HTTP policies, target groups and servers in them, health checks;
    • cloud firewalls and information about them in their project;
    • security groups and information about them in their project;

  • managing private networks, subnets, and ports in their project *;

  • managing public subnets, direct public IP addresses, and public floating IP addresses in their project;

  • managing cloud routers in their project;

  • managing load balancers, rules and HTTP policies, target groups, health checks, load balancer logging in all projects, as well as viewing load balancer statistics in their project;

  • managing cloud firewalls in their project;

  • managing security groups, rules, and ports in their project, as well as downloading a security group report in their project

* To manage connecting a subnet to a global router, you additionally need the global_router.admin role.

vpc.viewer

The vpc.viewer role grants access to viewing everything managed by vpc.admin in the same access scope.

Access scopesAccount
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of:

    • all cloud platform network resources and information about them in all projects;
    • cloud firewalls and information about them in all projects;
    • the list of security groups and information about them in all projects;

  • downloading a security group report in all projects

In the Project access scope:

  • viewing the list of:
    • all cloud platform network resources and information about them in their project
    • cloud firewalls and information about them in their project;
    • the list of security groups and information about them in their project;
  • downloading a security group report in their project

vpc.private_network.admin

The vpc.private_network.admin role grants access to managing:

Adding ports to a cloud server and deleting ports added to a cloud server is not available; this requires the member role.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing:

    • the list of private networks, subnets, and ports, and information about them in all projects;
    • information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones in all projects;

  • managing private networks, subnets, and ports in all projects *;

  • managing private DNS in all projects

In the Project access scope:

  • viewing:

    • the list of private networks, subnets, and ports, and information about them in their project;
    • information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones in their project;

  • managing private networks, subnets, and ports in their project *;

  • managing private DNS in their project

* To manage connecting a subnet to a cloud router, you additionally need the vpc.external_access.admin role. To connect to a global router, you need the global_router.admin role.

vpc.private_network.viewer

The vpc.private_network.viewer role grants access to viewing everything managed by vpc.private_network.admin in the same access scope.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of private networks, subnets, and ports, and information about them in all projects;
  • viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones in all projects

In the Project access scope:

  • viewing the list of private networks, subnets, and ports, and information about them in their project;
  • viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records and information about them in their project

vpc.external_access.admin

The vpc.external_access.admin role grants access to managing objects for Internet access: public subnets, direct public IP addresses, public floating IP addresses, and cloud routers. For details see Manage access to cloud platform networks.

Adding ports to a cloud server and deleting ports added to a cloud server is not available; this requires the compute.admin or compute.server.user role.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of public subnets and public IP addresses, ports in public networks, cloud routers, and information about them in all projects;
  • managing public subnets in all projects;
  • managing direct public IP addresses in all projects;
  • managing public floating IP addresses in all projects;
  • managing cloud routers in all projects *

In the Project access scope:

  • viewing the list of public subnets and public IP addresses, ports in public networks, cloud routers, and information about them in their project;
  • managing public subnets in their project;
  • managing direct public IP addresses in their project;
  • managing public floating IP addresses in their project;
  • managing cloud routers in their project *

* To manage connecting a private subnet to a cloud router, you additionally need the vpc.private_network.admin role.

vpc.external_access.user

The vpc.external_access.user role grants access:

Adding ports to a cloud server and deleting ports added to a cloud server is not available; this requires the compute.admin or compute.server.user role.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of public subnets, direct public IP addresses, and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects;
  • managing public floating IP addresses, except for creating and deleting public floating IP addresses, in all projects

In the Project access scope:

  • viewing the list of public subnets, direct public IP addresses, and public floating IP addresses, ports in public networks, cloud routers, and information about them in their project;
  • managing public floating IP addresses, except for creating and deleting public floating IP addresses, in their project

vpc.external_access.viewer

The vpc.external_access.viewer role grants access to viewing everything managed by vpc.external_access.admin in the same access scope.

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing the list of public subnets, direct public IP addresses, and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects

In the Project access scope:

  • viewing the list of public subnets, direct public IP addresses, and public floating IP addresses, ports in public networks, cloud routers, and information about them in their project

vpc.network_security.admin

The vpc.network_security.admin role grants access to managing tools for restricting traffic:

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing a list of:

    • cloud firewalls and information about them across all projects;
    • security groups and information about them across all projects *;

  • managing cloud firewalls across all projects;

  • managing security groups, rules, and ports across all projects *;

  • downloading a security group report across all projects **

In the Project access scope:

  • viewing a list of:

    • cloud firewalls and information about them in their project;
    • security groups and information about them in their project *;

  • managing cloud firewalls in their project;

  • managing security groups, rules, and ports in their project *;

  • downloading a security group report in their project **

* To view security groups and manage port assignments, you additionally need the role vpc.private_network.viewer or vpc.external_access.viewer.

** To download the report, you additionally need the combination of roles vpc.private_network.viewer and vpc.external_access.viewer, or the role vpc.viewer.

vpc.network_security.user

The vpc.network_security.user role grants access:

Access scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account access scope:

  • viewing a list of:

    • cloud firewalls and information about them across all projects;
    • security groups and information about them across all projects;

  • managing security group ports across all projects. In the Control panel, this action is available for the role only via the security group page (in the top menu, click Products → Cloud Servers → Security Groups → group page);

  • downloading a security group report across all projects *

In the Project access scope:

  • viewing a list of:

    • cloud firewalls and information about them in their project;
    • security groups and information about them in their project;

  • managing security group ports in their project. In the Control panel, this action is available for the role only via the security group page (in the top menu, click Products → Cloud Servers → Security Groups → group page);

  • downloading a security group report in their project *

* To download the report, you additionally need the combination of roles vpc.private_network.viewer and vpc.external_access.viewer, or the role vpc.viewer.

vpc.network_security.viewer

The vpc.network_security.viewer role grants view access to everything managed by vpc.network_security.admin in the same scope.

Scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account scope:

  • viewing the list of:

    • cloud firewalls and details about them across all projects;
    • security groups and details about them across all projects;

  • downloading a security group report across all projects *

In the Project scope:

  • viewing the list of:

    • cloud firewalls and details about them in the project;
    • security groups and details about them in the project;

  • downloading a security group report in the project *

* Downloading the report additionally requires a combination of the vpc.private_network.viewer and vpc.external_access.viewer roles, or the vpc.viewer role.

vpc.load_balancer.admin

The vpc.load_balancer.admin role grants access to Cloud Load Balancer management, for details see the instructions Manage access to Cloud Load Balancer.

Scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account scope:

  • viewing the list of all load balancer entities and details about them across all projects: load balancers, rules and HTTP policies, target groups and servers in them, and health checks;
  • viewing load balancer statistics across all projects;
  • managing load balancer entities, except for creating a load balancer, across all projects *;
  • enabling and disabling load balancer logging across all projects

In the Project scope:

  • viewing the list of all load balancer entities and details about them in the project: load balancers, rules and HTTP policies, target groups and servers in them, and health checks;
  • viewing load balancer statistics in the project;
  • managing load balancer entities, except for creating a load balancer, in the project *;
  • enabling and disabling load balancer logging in the project

* To create a load balancer, one or more additional roles are required. The additional roles depend on the network where the load balancer will be created:

vpc.load_balancer.viewer

The vpc.load_balancer.viewer role grants view access to everything managed by vpc.load_balancer.admin in the same scope.

Scopes
  • account;
  • project
Can be assigned to
  • users;
  • service users;
  • user groups
Available operations

In the Account scope:

  • viewing the list of all load balancer entities and details about them across all projects: load balancers, rules and HTTP policies, target groups and servers in them, and health checks

In the Project scope:

  • viewing the list of all load balancer entities and details about them in the project: load balancers, rules and HTTP policies, target groups and servers in them, and health checks