Manage cloud platform network access

Cloud platform network access is governed by:

• projects — define access within an isolated group of resources;
• role model — defines access for different users within an account and project.

Access within the role model

Read more about access within the role model in the instruction Access management in Servercore products.

This instruction describes the roles for accessing network resources in the cloud platform: private networks, subnets and ports, public subnets and ports, direct public IP addresses, public floating IP addresses, and cloud routers. Access to load balancers, access to cloud firewalls, and access to security groups are regulated separately.

member

A user with full access to all services. Access management is unavailable for: users, service users, user groups, and federations.

Access scopes	Account Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects; managing private networks, subnets, and ports in all projects: creating and deleting a network and subnet; changing the name and tags of a network and subnet; configuring network access in different projects; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; connecting a network to a global router and disconnecting it; creating a port in a network and deleting a port; enabling and disabling a port in a network; managing allowed addresses and security groups on a port in a network; managing public subnets in all projects: creating and deleting a subnet; changing the name and tags of a subnet; changing DNS servers; configuring access to a subnet in different projects; creating and deleting a port in a subnet; managing direct public IP addresses in all projects: creating an IP address with an associated port; deleting an IP address with an associated port; enabling and disabling a port with an IP address; managing public floating IP addresses in all projects: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in all projects: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project; managing private networks, subnets, and ports in your project: creating and deleting a network and subnet; changing network and subnet names and tags; configuring network access in different projects (access to each project is required); changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; creating a port in a network and deleting a port; enabling and disabling a port in a network; managing allowed addresses and security groups on a port; managing public subnets in your project: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; configuring access to a subnet in different projects; creating and deleting a port in a subnet; enabling and disabling a port in a network; managing direct public IP addresses in your project: creating an IP address with an associated port; deleting an IP address with an associated port; changing a port with an IP address; detaching a port; managing public floating IP addresses in your project: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in your project: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them

iam.admin

A user with access to user management and no access to services or billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	Manage users, service users, user groups with access to cloud platform networks, as well as management of federations

iam.viewer

User with access to view everything that iam.admin manages.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	Viewing users, service users, user groups, and federations; viewing user keys; viewing notifications of other users; viewing account access restrictions

reader

User with access to view everything that member manages in the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project

vpc.admin

User with access to managing cloud platform networks (private networks and subnets, public subnets and public floating IP addresses, cloud routers), cloud firewalls, security groups, and cloud load balancers.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the member role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects; managing private networks, subnets, and ports in all projects: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; connecting a subnet to a global router and disconnecting it (also requires the global_router.admin role); creating a port in a network (without adding it to a cloud server) and deleting a port in a network (except for those added to a cloud server); enabling and disabling a port in a network; managing public subnets in all projects: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network; managing direct public IP addresses in all projects: creating an IP address with an associated port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing public floating IP addresses in all projects: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in all projects: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project; managing private networks, subnets, and ports in your project: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; connecting a subnet to a global router and disconnecting it (also requires the global_router.admin role); creating a port in a network (without adding it to a cloud server) and deleting a port in a network (except for those added to a cloud server); enabling and disabling a port in a network; managing public subnets in your project: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network; managing public floating IP addresses in your project: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing direct public IP addresses in your project: creating an IP address with an associated port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing cloud routers in your project: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them

vpc.viewer

User with access to view everything that vpc.admin manages in the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project

vpc.private_network.admin

User with access to managing private networks, subnets, and ports.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the member role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of private networks, subnets, ports, and information about them in all projects; managing private networks, subnets, and ports in all projects: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it (also requires the vpc.external_access.admin role); connecting a subnet to a global router and disconnecting it (also requires the global_router.admin role); creating a port in a network (without assigning to a cloud server) and deleting a port in a network (except for those assigned to a cloud server); enabling and disabling a port in a network
	In the Project access scope: viewing the list of private networks, subnets, ports, and information about them in your project; managing private networks, subnets, and ports in your project: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it (also requires the vpc.external_access.admin role); connecting a subnet to a global router and disconnecting it (also requires the global_router.admin role); creating a port in a network (without assigning to a cloud server) and deleting a port in a network (except for those assigned to a cloud server); enabling and disabling a port in a network

vpc.private_network.viewer

User with access to view everything that vpc.private_network.admin manages in the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of private networks, subnets, ports, and information about them in all projects
	In the Project access scope: viewing the list of private networks, subnets, ports, and information about them in your project

vpc.external_access.admin

User with access to managing objects for internet access — public subnets, public floating IP addresses, cloud routers.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the compute.admin role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects; managing public subnets in all projects: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network managing direct public IP addresses in all projects: creating an IP address with an associated port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing public floating IP addresses in all projects: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in all projects: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them (also requires the vpc.private_network.admin)
	In the Project access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project; managing public subnets in your project: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network managing direct public IP addresses in your project: creating an IP address with an associated port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with an associated port (except for those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing public floating IP addresses in your project: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in your project: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them (also requires the vpc.private_network.admin)

vpc.external_access.user

User with access to view everything that vpc.external_access.admin manages in the same access scope, as well as access to managing public floating IP addresses.

Adding ports to a cloud server and deleting ports added to a cloud server are unavailable; this requires the compute.admin role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects; managing public floating IP addresses in all projects: attaching an IP address to a port in a private network, switching between ports, detaching from a port
	In the Project access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project; managing public floating IP addresses in your project: attaching an IP address to a port in a private network, switching between ports, detaching from a port

vpc.external_access.viewer

User with access to view everything that vpc.external_access.admin manages in the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects
	In the Project access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project