diff --git a/docs/sources/administration/roles-and-permissions/access-control/assign-rbac-roles/index.md b/docs/sources/administration/roles-and-permissions/access-control/assign-rbac-roles/index.md index 0cca046cbdf..1ec0242f7dd 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/assign-rbac-roles/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/assign-rbac-roles/index.md @@ -56,8 +56,6 @@ This section describes how to: In both cases, the assignment applies only to the user, team or service account within the affected organization, and no other organizations. For example, if you grant the user the **Data source editor** role in the **Main** organization, then the user can edit data sources in the **Main** organization, but not in other organizations. -
- **Before you begin:** - [Plan your RBAC rollout strategy](ref:plan-rbac-rollout-strategy). @@ -71,8 +69,6 @@ In both cases, the assignment applies only to the user, team or service account - Your Grafana user can also assign fixed role if it has either the `fixed:roles:writer` fixed role assigned to the same organization to which you are assigning RBAC to a user, or a custom role with `users.roles:add` and `users.roles:remove` permissions. - Your own user account must have the roles you are granting. For example, if you would like to grant the `fixed:users:writer` role to a team, you must have that role yourself. -
- **To assign a fixed role to a user, team or service account:** 1. Sign in to Grafana. @@ -93,6 +89,35 @@ In both cases, the assignment applies only to the user, team or service account 1. Select a role within an organization that you want to assign to the user. 1. Click **Save**. +## Assign fixed or custom roles using the HTTP API + +This section describes how to: + +- Assign a fixed role to a user, team or service account as an organization administrator. + +**Before you begin:** + +- [Plan your RBAC rollout strategy](ref:plan-rbac-rollout-strategy). +- Identify the fixed roles that you want to assign to the user, team or service account. + + For more information about available fixed roles, refer to [RBAC role definitions](ref:rbac-role-definitions). + +- Ensure that your own user account has the correct permissions: + - If you are assigning permissions to a user, team or service account within an organization, you must have organization administrator or server administrator permissions. + - If you are assigning permissions to a user who belongs to multiple organizations, you must have server administrator permissions. + - Your Grafana user can also assign fixed role if it has either the `fixed:roles:writer` fixed role assigned to the same organization to which you are assigning RBAC to a user, or a custom role with `users.roles:add` and `users.roles:remove` permissions. + - Your own user account must have the roles you are granting. For example, if you would like to grant the `fixed:users:writer` role to a team, you must have that role yourself. + +**To assign a fixed role to a user or service account:** + +Refer to the [RBAC HTTP API for user role assignment](/docs/grafana//developers/http_api/access_control/#add-a-user-role-assignment). + +The service account ID can be used in place of the user ID. + +**To assign a fixed role to a team:** + +Refer to the [RBAC HTTP API for team role assignment](/docs/grafana//developers/http_api/access_control/#add-a-team-role-assignment). + ## Assign fixed or custom roles to a team using provisioning Instead of using the Grafana role picker, you can use file-based provisioning to assign fixed roles to teams. If you have a large number of teams, provisioning can provide an easier approach to assigning and managing role assignments. diff --git a/docs/sources/administration/service-accounts/_index.md b/docs/sources/administration/service-accounts/_index.md index eac4ac84d1e..b853496c094 100644 --- a/docs/sources/administration/service-accounts/_index.md +++ b/docs/sources/administration/service-accounts/_index.md @@ -161,8 +161,8 @@ By default, service account tokens don't have an expiration date, meaning they w ## Assign roles to a service account in Grafana -You can assign roles to a Grafana service account to control access for the associated service account tokens. -You can assign roles to a service account using the Grafana UI or via the API. For more information about assigning a role to a service account via the API, refer to [Update service account using the HTTP API](ref:api-update-service-account). +You can assign organization roles (`Viewer`, `Editor`, `Admin`) to a Grafana service account to control access for the associated service account tokens. +You can assign organization roles to a service account using the Grafana UI or via the API. For more information about assigning a role to a service account via the API, refer to [Update service account using the HTTP API](ref:api-update-service-account). In [Grafana Enterprise](/docs/grafana//introduction/grafana-enterprise/), you can also [assign RBAC roles](ref:rbac-assign-rbac-roles) to grant very specific permissions to applications that interact with Grafana.