You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
YugabyteDB Anywhere uses a role-based access control (RBAC) model to manage access to your YugabyteDB Anywhere instance (whether via the UI or the REST API). Using roles, you can enforce the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege) (PoLP) by ensuring that users have the precise permissions needed to fulfill their roles while mitigating the risk of unauthorized access or accidental breaches. A role defines a set of permissions that determine what features can be accessed by account users who have been assigned that role.
17
16
18
-
{{< note title="Early Access">}}
17
+
Starting with v2.20.1, RBAC is available with fine-grained control over access to universes. {{<badge/ea>}}
19
18
20
-
RBAC with the ability to limit users to manage only a subset of universes is [Early Access](/preview/releases/versioning/#feature-availability).
19
+
{{< note title="Fine-grained RBAC is Early Access">}}
21
20
22
-
By default, RBAC is not enabled. To enable the feature, use following API command:
21
+
Fine-grained RBAC with the ability to limit users to manage only a subset of universes is [Early Access](/preview/releases/versioning/#feature-availability).
22
+
23
+
During EA, by default fine-grained RBAC is not enabled. To enable the feature, use following API command:
23
24
24
25
```sh
25
26
curl --request PUT \
@@ -29,21 +30,92 @@ curl --request PUT \
29
30
--data 'true'
30
31
```
31
32
32
-
Note that if you enable RBAC, you can't turn it off. You should test the feature thoroughly in a development or staging environment before enabling it in your production environment.
33
+
Note that if you enable fine-grained RBAC, you can't turn it off. You should test the feature thoroughly in a development or staging environment before enabling it in your production environment.
33
34
34
35
{{</note >}}
35
36
36
-
## Users
37
+
## Users and roles
37
38
38
39
A user can interact with a YugabyteDB Anywhere through the UI or REST API.
39
40
40
-
Users are assigned [roles](#roles), which define the set of actions users can perform. You can also define a set of universes to which the user has access.
41
+
Users are assigned roles, which define the set of actions users can perform. If fine-grained RBAC is enabled, you can also define the set of universes to which the user has access.
42
+
43
+
YugabyteDB Anywhere includes built-in roles. If you have enabled fine-grained RBAC, you can also define custom roles for team members to restrict access to specific account features.
44
+
45
+
[API tokens](../../anywhere-automation/) generated for users are assigned the same role as the user that generated them.
46
+
47
+
### Built-in roles
48
+
49
+
The following built-in roles are available:
50
+
51
+
-**Super Admin** is the first user that is created during installation. This role has the highest level of privilege and allows all read and write actions on all YugabyteDB Anywhere resources. There can be only one Super Admin. Super Admin can perform the following:
52
+
53
+
- Manage all resources, including universes, nodes, backup, restore, and cloud providers.
54
+
- Manage the user access control by creating and managing users.
55
+
56
+
For more information, see [Create admin user](../../configure-yugabyte-platform/create-admin-user/).
57
+
58
+
-**Admin** has privileges that are similar to the Super Admin, except that Admin cannot manage global scope artifacts and actions, such as runtime configuration settings and LDAP authentication.
59
+
60
+
-**Backup Admin** has access to backup-related tasks, such as the following:
61
+
62
+
- Manage database backups and restore operations.
63
+
- Create new backups.
64
+
- Delete any existing backup or backup schedule.
65
+
- Edit existing backups.
66
+
67
+
Backup Admin has view permissions for all other resources.
68
+
69
+
-**Read Only** access level provides view permissions for the UI and API.
70
+
71
+
-**Connect Only** access level allows users to sign in and access their user profile only. This role is assigned to users who are not explicitly assigned a role.
41
72
42
-
### Create, modify, and delete users
73
+
You can't delete or edit built-in roles.
74
+
75
+
## Manage users
43
76
44
77
As a Super Admin or Admin, you can invite new users and manage existing users for your YugabyteDB Anywhere instance.
45
78
46
-
You can assign built-in and custom roles to users to determine the actions they are allowed to perform, and specify the universes that they can access.
79
+
How you add and modify users varies depending on whether you have enabled fine-grained RBAC. You can only assign, create, and modify custom roles if you have enabled fine-grained RBAC.
1. Select a [built-in role](#built-in-roles) for the user.
109
+
110
+
1. Click **Submit**.
111
+
112
+
To modify a user role, navigate to **Admin > User Management > Users**, click **Actions** that corresponds to the specific user, and choose **Edit User Role**.
Using fine-grained RBAC, you can assign built-in and custom roles to users to determine the actions they are allowed to perform, and specify the universes that they can access.
47
119
48
120
To create a user, do the following:
49
121
@@ -52,6 +124,7 @@ To create a user, do the following:
1. To assign a built-in role, under **Built-in Role**, click **Assign New Built-in Role**, and select a built-in role.
56
129
1. To assign a custom role, under **Custom Role**, click **Assign New Custom Role**, and select a custom role.
57
130
@@ -71,47 +144,15 @@ To modify a user, do the following:
71
144
1. To customize access to universes, click **Edit Selection**, and select the universes that you want to grant access for. Select the **Include future universes** option to automatically grant access to any universe created in the future. Click **Confirm** when you are done.
72
145
1. Click **Edit User**.
73
146
74
-
To delete a user, navigate to **Admin > Access Management > Users**, click **Actions** for the user to delete, and choose **Delete User**.
75
-
76
-
## Roles
77
-
78
-
YugabyteDB Anywhere includes built-in roles, and you can define custom roles for team members to restrict access to specific account features.
79
-
80
-
[API tokens](../../anywhere-automation/) generated for users are assigned the same role as the user that generated them.
81
-
82
-
To see the users that are assigned a specific role, navigate to **Admin > Access Management > Roles**, click **Actions** for the role, and choose **View Assigned Users**.
83
-
84
-
### Built-in roles
85
-
86
-
The following built-in roles are available:
87
-
88
-
-**Super Admin** is the first user that is created during installation. This role has the highest level of privilege and allows all read and write actions on all YugabyteDB Anywhere resources. There can be only one Super Admin. Super Admin can perform the following:
89
-
90
-
- Manage all resources, including universes, nodes, backup, restore, and cloud providers.
91
-
- Manage the user access control by creating and managing users.
92
-
93
-
For more information, see [Create admin user](../../configure-yugabyte-platform/create-admin-user/).
94
-
95
-
-**Admin** has privileges that are similar to the Super Admin, except that Admin cannot manage global scope artifacts and actions, such as runtime configuration settings and LDAP authentication.
96
-
97
-
-**Backup Admin** has access to backup-related tasks, such as the following:
98
-
99
-
- Manage database backups and restore operations.
100
-
- Create new backups.
101
-
- Delete any existing backup or backup schedule.
102
-
- Edit existing backups.
147
+
</div>
103
148
104
-
Backup Admin has View permissions for all other resources.
149
+
</div>
105
150
106
-
-**Read-only** access level provides view permissions for the UI and API.
107
-
108
-
-**Connect-only** access level allows users to sign in and access their user profile only. This role is assigned to users who are not explicitly assigned a role.
109
-
110
-
You can't delete or edit built-in roles.
151
+
To delete a user, navigate to **Admin > Access Management > Users**, click **Actions** for the user to delete, and choose **Delete User**.
111
152
112
-
### Create, modify, and delete roles
153
+
##Manage custom roles
113
154
114
-
As a Super Admin or Admin, you can:
155
+
If fine-grained RBAC is enabled, as a Super Admin or Admin, you can:
115
156
116
157
- create custom roles
117
158
- clone built-in and custom roles
@@ -149,7 +190,7 @@ To delete a role, navigate to **Admin > Access Management > Roles**, click **Act
149
190
150
191
To view the users that have been assigned a role, navigate to **Admin > Access Management > Roles**, click **Actions** for the role, and choose **View Assigned Users**.
151
192
152
-
## Limitations
193
+
## Fine-grained RBAC limitations
153
194
154
195
- Currently, the View Universe permission additionally requires the View Resource permission to work correctly with metrics, performance advisor, and other resources.
155
196
- Deleting backups via the delete backup API requires the Delete Resource permission, but when deleting a universe you can choose to delete the associated backups even if you only have the Delete Universe permission.
0 commit comments