Use built-in and custom roles
Grant access with the four built-in roles or your own custom roles, assign them at subscription or project scope, and remove them when access ends.
A role sets what its holder can do: for each permission resource, such as Networking or Identity & Access, it grants None, Read, or Manage. You give a role to a member or a service account at a scope, the subscription or one project. That's a role assignment, and role assignments are what the platform checks on every request.
Before you begin
- To create, edit, or delete custom roles and to assign roles, you need the Owner role, or a custom role with Manage access to Identity & Access.
- To view roles and their assignments, any role with Read access to Identity & Access is enough.
Built-in roles
Every organization has four built-in roles. You can't edit or delete them, but you can clone them into custom roles.
| Role | What it can do |
|---|---|
| Owner | Manage everything: resources, members, roles, API tokens, billing, and budgets. |
| Contributor | Manage compute, storage, networking, load balancers, and alerts. View billing, budgets, members and roles, API tokens, and the activity log. |
| Reader | View everything. Change nothing. |
| Billing Operator | Manage billing and budgets. No access to resources, members, or the activity log. |
The roles are ranked in this order, from Owner down to Billing Operator.
Scopes
| Scope | Where the role applies |
|---|---|
| Subscription | The subscription and every project in it. |
| Project | That project only. |
For how several assignments add up, who can grant which role, and which settings and billing resources need a role on the subscription, see Role assignments.
Assign a role to a member
In the console, go to Identity & AccessUsers, and select the member.
Select Assign role.
In Role, select the role.
In Scope, select the current project, or the subscription. The subscription is offered only when you manage Identity & Access on the subscription.
Select Assign role to confirm.
The console confirms that the assignment is being provisioned. When it's done, the role appears on the member's Roles & access tab.
To give several members the same role, select them in the member list, and select Assign role. The dialog has the same fields.
Assign a role from the role's page
Use this to grant a role to a service account, or to see everyone who holds a role.
Go to Identity & AccessRoles, and select the role.
On the Assignments tab, select Add assignment.
In Principal, select a member or a service account.
In Scope, select the project or the subscription.
Select Grant.
The Assignments tab lists who holds the role in the current project and its subscription.
Remove a role from a member
Go to Identity & AccessUsers, and select the member.
On the Roles & access tab, select Remove on the role's row.
Read the confirmation, and select Remove.
This removes every assignment of that role the member holds in your organization, at every scope, not only the row you selected. If the removal lowers the member's OpenStack role in a project, their OpenStack application credentials for that project are deleted. The confirmation lists the credentials that would be deleted. See How it works.
You can't remove your own Owner role.
Create a custom role
Go to Identity & AccessRoles, and select Create custom role.
Enter a Role name and, optionally, a Description.
Under Assignable scopes, select where the role can be granted: Subscription, Project, or both.
Under Permissions, set each resource to None, Read, or Manage.
Select Create role.
| Field | Rules |
|---|---|
| Role name | 2–63 characters: letters, digits, spaces, hyphens, and underscores, starting with a letter. Unique in your organization, ignoring case. It can't be the ID of a built-in role. |
| Description | Optional. |
| Assignable scopes | At least one. |
| Permissions | You can't give the role a permission that you don't hold yourself. |
Read lets the holder view a resource. Manage lets the holder view and change it. These are the main permission resources:
| Resource | What it covers |
|---|---|
| Compute / Instances | Instances, images, key pairs, and instance snapshots. |
| Block & Object Storage | Volumes, volume snapshots, backups, and Object Storage. |
| Networking | Networks, routers, security groups, Floating IPs, and VPN. |
| Load Balancers | Load balancers. |
| Observability | Alert rules and their notification channels. |
| Billing & Cost | Cost, invoices, credits, quotas, and subscriptions. |
| Budgets | Budgets and budget alerts. Viewing or changing budgets also needs at least the same level on Billing & Cost. |
| Identity & Access | Members, roles, and service accounts. |
| API Tokens | API tokens. |
| Audit Log | The activity log. |
Clone a role
Clone a built-in or custom role to start a custom role from its permissions.
Go to Identity & AccessRoles. On the role's row, open the menu, and select Clone.
The form opens with the role's settings. Change the name and the permissions as you need.
Select Create role.
Edit or delete a custom role
- Edit. On the custom role's row, open the menu, and select Edit. Make your changes, and select Save changes. The changes apply to every assignment of the role.
- Delete. On the custom role's row, open the menu, and select Delete. In the dialog, select Delete role. Everyone who held the role loses the access it gave them. You can't undo this.
Important
If an edit or a deletion lowers a holder's OpenStack role in a project, the holder's OpenStack application credentials for that project are deleted. Before you change a role, check who holds it on its Assignments tab. See How it works.
Allow a member to create projects
Creating projects in a subscription takes the Owner role on the subscription, or a separate project creation grant. Owning a project isn't enough.
Go to Identity & AccessUsers, and select the member.
On the Roles & access tab, under Project creation, select Allow project creation.
- Only an owner of the subscription sees this panel and can change the grant.
- The member must already have a role on the subscription or on one of its projects.
- The grant lets the member create projects in this subscription, and nothing else: it gives no access to other projects and no billing access.
- To take it back, select Revoke project creation.
To create a project with the grant, see Create a project.