Skip to main content

How to configure permissions

Access is given by assigning a group to a person, on a target. This page covers the three things you will do in practice: assigning a group, building your own, and the exception case of granting a single permission.

Prerequisites​

  • iam:group:assign to assign groups, iam:group:manage to create them, iam:grant:create for direct grants.
  • The vocabulary in What is IAM.

Assign a group to someone​

  1. Open IAM and go to the Assigned groups tab.
  2. Click Assign group.
  3. User: pick the person.
  4. Group: pick the group. Only the groups you are allowed to hand out appear here.
  5. Target: pick the customer or VDC the access applies to. The scope itself comes from the group, so there is nothing to choose there. A VDC group asks for a VDC, a customer group asks for a customer.
  6. Governance: write the reason. It is required and recorded in the audit log.
  7. Check the summary and confirm.

The access takes effect on the person's next token refresh, within about five minutes.

Group access does not expire. It lasts until someone removes the assignment.

Create your own group​

When neither default group fits, build one:

  1. Go to the Groups tab and click Create group.
  2. Give it a name and a description that says what the group is for.
  3. Choose the scope type it can be assigned at. This is the decision that matters most: a VDC group can only ever be assigned to VDCs, and a customer group only to customers. It cannot be changed by assignment later.
  4. Pick its permissions from the catalog. Filter by domain to find them.
  5. Save, then assign it exactly like a default group.

Built-in groups are read only. To start from one, duplicate it and edit the copy.

Grant a single permission​

For a one-off exception, skip groups entirely:

  1. Go to the Grants tab and click Create grant.
  2. Pick the person and the permission.
  3. Choose the scope and, when it needs one, the target. A permission is not tied to a single level the way a group is, so here you do pick the scope.
  4. Set an expiry date. It is mandatory and has to be in the future.
  5. Write the reason and confirm.

See How to give temporary access for renewing and revoking.

Use this sparingly. If several people need the same exception, create a group instead. Grants scattered across users are what makes access impossible to review later.

Notes​

  • You cannot grant what you do not hold. The lists are filtered to your own access, on the target you picked.
  • Permissions only add up. To take access away, remove the assignment or revoke the grant. There is no deny rule.
  • Use the Permissions tab on a person to see everything they hold and where each item came from.