mirror of
https://github.com/grafana/grafana.git
synced 2025-01-23 23:13:52 -06:00
adjusts access control directory structure (#54865)
This commit is contained in:
Christopher Moyer
GitHub
parent
108678a8cc
commit
5b830e131e
@ -5,6 +5,7 @@ aliases:
|
||||
- /docs/grafana/latest/permissions/
|
||||
- /docs/grafana/latest/permissions/organization_roles/
|
||||
- /docs/grafana/latest/permissions/overview/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/
|
||||
description: Information about Grafana user, team, and organization roles and permissions
|
||||
title: Roles and permissions
|
||||
weight: 300
|
||||
|
||||
@ -4,6 +4,7 @@ aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/
|
||||
- /docs/grafana/latest/enterprise/access-control/about-rbac/
|
||||
- /docs/grafana/latest/enterprise/access-control/roles/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/
|
||||
description: Role-based access control (RBAC) provides a standardized way of granting,
|
||||
changing, and revoking access so that users can view and modify Grafana resources,
|
||||
such as users and reports.
|
||||
|
||||
@ -3,6 +3,7 @@ aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/assign-rbac-roles/
|
||||
- /docs/grafana/latest/enterprise/access-control/manage-role-assignments/manage-built-in-role-assignments/
|
||||
- /docs/grafana/latest/enterprise/access-control/manage-role-assignments/manage-user-role-assignments/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/assign-rbac-roles/
|
||||
description: Learn how to assign RBAC roles to users and teams in Grafana.
|
||||
menuTitle: Assign RBAC roles
|
||||
title: Assign Grafana RBAC roles
|
||||
@ -11,7 +12,7 @@ weight: 40
|
||||
|
||||
# Assign RBAC roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
In this topic you'll learn how to use the role picker, provisioning, and the HTTP API to assign fixed and custom roles to users and teams.
|
||||
|
||||
@ -46,7 +47,7 @@ In both cases, the assignment applies only to the user, team or service account
|
||||
1. Sign in to Grafana.
|
||||
2. Switch to the organization that contains the user, team or service account.
|
||||
|
||||
For more information about switching organizations, refer to [Switch organizations]({{< relref "../../user-management/user-preferences/_index.md#switch-organizations" >}}).
|
||||
For more information about switching organizations, refer to [Switch organizations]({{< relref "../../../user-management/user-preferences/_index.md#switch-organizations" >}}).
|
||||
|
||||
3. Hover your cursor over **Configuration** (the gear icon) in the left navigation menu, and click **Users** or **Teams** or **Service Accounts**.
|
||||
4. In the **Role** column, select the fixed role that you want to assign to the user, team or service account.
|
||||
@ -70,7 +71,7 @@ Instead of using the Grafana role picker, you can use file-based provisioning to
|
||||
**Before you begin:**
|
||||
|
||||
- Refer to [Role provisioning]({{< relref "./rbac-provisioning/#rbac-provisioning" >}})
|
||||
- Ensure that the team to which you are adding the fixed role exists. For more information about creating teams, refer to [Manage teams]({{< relref "../../team-management/" >}})
|
||||
- Ensure that the team to which you are adding the fixed role exists. For more information about creating teams, refer to [Manage teams]({{< relref "../../../team-management/" >}})
|
||||
|
||||
**To assign a role to a team:**
|
||||
|
||||
@ -96,7 +97,7 @@ Instead of using the Grafana role picker, you can use file-based provisioning to
|
||||
|
||||
1. Reload the provisioning configuration file.
|
||||
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
|
||||
The following example creates the `custom:users:writer` role and assigns it to the `user writers` and `user admins` teams along with the `fixed:users:writer` role:
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
---
|
||||
aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/configure-rbac/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/configure-rbac/
|
||||
description: Learn how to configure RBAC.
|
||||
menuTitle: Configure RBAC
|
||||
title: Configure RBAC in Grafana
|
||||
@ -9,9 +10,9 @@ weight: 30
|
||||
|
||||
# Configure RBAC in Grafana
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
The table below describes all RBAC configuration options. Like any other Grafana configuration, you can apply these options as [environment variables]({{< relref "../../../setup-grafana/configure-grafana/#configure-with-environment-variables" >}}).
|
||||
The table below describes all RBAC configuration options. Like any other Grafana configuration, you can apply these options as [environment variables]({{< relref "../../../../setup-grafana/configure-grafana/#configure-with-environment-variables" >}}).
|
||||
|
||||
| Setting | Required | Description | Default |
|
||||
| ------------------ | -------- | ---------------------------------------------------------------------------- | ------- |
|
||||
@ -2,6 +2,7 @@
|
||||
aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/custom-role-actions-scopes/
|
||||
- /docs/grafana/latest/enterprise/access-control/permissions/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/custom-role-actions-scopes/
|
||||
description: Learn about Grafana RBAC permissions, actions, and scopes.
|
||||
menuTitle: RBAC permissions, actions, and scopes
|
||||
title: Grafana RBAC permissions, actions, and scopes
|
||||
@ -10,7 +11,7 @@ weight: 80
|
||||
|
||||
# RBAC permissions, actions, and scopes
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
A permission is comprised of an action and a scope. When creating a custom role, consider the actions the user can perform and the resource(s) on which they can perform those actions.
|
||||
|
||||
@ -110,8 +111,8 @@ The following list contains role-based access control actions.
|
||||
| `serviceaccounts:read` | `serviceaccounts:*` | Read Grafana service accounts. |
|
||||
| `serviceaccounts.permissions:write` | `serviceaccounts:*` | Update Grafana service account permissions to control who can do what with the service account. |
|
||||
| `serviceaccounts.permissions:read` | `serviceaccounts:*` | Read Grafana service account permissions to see who can do what with the service account. |
|
||||
| `settings:read` | `settings:*`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Read the [Grafana configuration settings]({{< relref "../../../setup-grafana/configure-grafana/" >}}) |
|
||||
| `settings:write` | `settings:*`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Update any Grafana configuration settings that can be [updated at runtime]({{< relref "../../../enterprise/settings-updates/" >}}). |
|
||||
| `settings:read` | `settings:*`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Read the [Grafana configuration settings]({{< relref "../../../../setup-grafana/configure-grafana/" >}}) |
|
||||
| `settings:write` | `settings:*`<br>`settings:auth.saml:*`<br>`settings:auth.saml:enabled` (property level) | Update any Grafana configuration settings that can be [updated at runtime]({{< relref "../../../../enterprise/settings-updates/" >}}). |
|
||||
| `status:accesscontrol` | `services:accesscontrol` | Get access-control enabled status. |
|
||||
| `teams.permissions:read` | `teams:*`<br>`teams:id:*` | Read members and External Group Synchronization setup for teams. |
|
||||
| `teams.permissions:write` | `teams:*`<br>`teams:id:*` | Add, remove and update members and manage External Group Synchronization setup for teams. |
|
||||
@ -3,6 +3,7 @@ aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/manage-rbac-roles/
|
||||
- /docs/grafana/latest/enterprise/access-control/manage-role-assignments/
|
||||
- /docs/grafana/latest/enterprise/access-control/provisioning/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/manage-rbac-roles/
|
||||
description: Learn how to view permissions associated with roles, create custom roles,
|
||||
and update and delete roles in Grafana.
|
||||
menuTitle: Manage RBAC roles
|
||||
@ -12,7 +13,7 @@ weight: 50
|
||||
|
||||
# Manage RBAC roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
This section includes instructions for how to view permissions associated with roles, create custom roles, and update and delete roles.
|
||||
|
||||
@ -20,7 +21,7 @@ The following example includes the base64 username:password Basic Authorization.
|
||||
|
||||
## List permissions associated with roles
|
||||
|
||||
Use a `GET` command to see the actions and scopes associated with a role. For more information about seeing a list of permissions for each role, refer to [Get a role]({{< relref "../../../developers/http_api/access_control/#get-a-role" >}}).
|
||||
Use a `GET` command to see the actions and scopes associated with a role. For more information about seeing a list of permissions for each role, refer to [Get a role]({{< relref "../../../../developers/http_api/access_control/#get-a-role" >}}).
|
||||
|
||||
To see the permissions associated with basic roles, refer to the following basic role UIDs:
|
||||
|
||||
@ -78,7 +79,7 @@ curl --location --request GET '<grafana_url>/api/access-control/roles/qQui_LCMk'
|
||||
}
|
||||
```
|
||||
|
||||
Refer to the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#get-a-role" >}}) for more details.
|
||||
Refer to the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#get-a-role" >}}) for more details.
|
||||
|
||||
## Create custom roles
|
||||
|
||||
@ -107,7 +108,7 @@ File-based provisioning is one method you can use to create custom roles.
|
||||
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| `name` | A human-friendly identifier for the role that helps administrators understand the purpose of a role. `name` is required and cannot be longer than 190 characters. We recommend that you use ASCII characters. Role names must be unique within an organization. |
|
||||
| `uid` | A unique identifier associated with the role. The UID enables you to change or delete the role. You can either generate a UID yourself, or let Grafana generate one for you. You cannot use the same UID within the same Grafana instance. |
|
||||
| `orgId` | Identifies the organization to which the role belongs. The [default org ID]({{< relref "../../../setup-grafana/configure-grafana/#auto_assign_org_id" >}}) is used if you do not specify `orgId`. |
|
||||
| `orgId` | Identifies the organization to which the role belongs. The [default org ID]({{< relref "../../../../setup-grafana/configure-grafana/#auto_assign_org_id" >}}) is used if you do not specify `orgId`. |
|
||||
| `global` | Global roles are not associated with any specific organization, which means that you can reuse them across all organizations. This setting overrides `orgId`. |
|
||||
| `displayName` | Human-friendly text that is displayed in the UI. Role display name cannot be longer than 190 ASCII-based characters. For fixed roles, the display name is shown as specified. If you do not set a display name the display name replaces `':'` (a colon) with `' '` (a space). |
|
||||
| `description` | Human-friendly text that describes the permissions a role provides. |
|
||||
@ -121,7 +122,7 @@ File-based provisioning is one method you can use to create custom roles.
|
||||
|
||||
1. Reload the provisioning configuration file.
|
||||
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
|
||||
The following example creates a local role:
|
||||
|
||||
@ -190,7 +191,7 @@ roles:
|
||||
|
||||
### Create custom roles using the HTTP API
|
||||
|
||||
The following examples show you how to create a custom role using the Grafana HTTP API. For more information about the HTTP API, refer to [Create a new custom role]({{< relref "../../../developers/http_api/access_control/#create-a-new-custom-role" >}}).
|
||||
The following examples show you how to create a custom role using the Grafana HTTP API. For more information about the HTTP API, refer to [Create a new custom role]({{< relref "../../../../developers/http_api/access_control/#create-a-new-custom-role" >}}).
|
||||
|
||||
> **Note:** You cannot create a custom role with permissions that you do not have. For example, if you only have `users:create` permissions, then you cannot create a role that includes other permissions.
|
||||
|
||||
@ -239,7 +240,7 @@ curl --location --request POST '<grafana_url>/api/access-control/roles/' \
|
||||
}
|
||||
```
|
||||
|
||||
Refer to the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#create-a-new-custom-role" >}}) for more details.
|
||||
Refer to the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#create-a-new-custom-role" >}}) for more details.
|
||||
|
||||
## Update basic role permissions
|
||||
|
||||
@ -265,7 +266,7 @@ If the default basic role definitions do not meet your requirements, you can cha
|
||||
|
||||
1. Reload the provisioning configuration file.
|
||||
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
|
||||
The following example modifies the `Grafana Admin` basic role permissions.
|
||||
|
||||
@ -304,7 +305,7 @@ roles:
|
||||
> **Note**: You can add multiple `fixed`, `basic` or `custom` roles to the `from` section. Their permissions will be copied and added to the basic role.
|
||||
> <br/> **Note**: Make sure to **increment** the role version for the changes to be accounted for.
|
||||
|
||||
You can also change basic roles' permissions using the API. Refer to the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}) for more details.
|
||||
You can also change basic roles' permissions using the API. Refer to the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#update-a-role" >}}) for more details.
|
||||
|
||||
## Reset basic roles to their default
|
||||
|
||||
@ -329,7 +330,7 @@ This section describes how to reset the basic roles to their default:
|
||||
scope: 'permissions:type:escalate'
|
||||
```
|
||||
|
||||
1. As a `Grafana Admin`, call the API endpoint to reset the basic roles to their default. Refer to the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#reset-basic-roles-to-their-default" >}}) for more details.
|
||||
1. As a `Grafana Admin`, call the API endpoint to reset the basic roles to their default. Refer to the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#reset-basic-roles-to-their-default" >}}) for more details.
|
||||
|
||||
## Delete a custom role using Grafana provisioning
|
||||
|
||||
@ -355,7 +356,7 @@ Delete a custom role when you no longer need it. When you delete a custom role,
|
||||
|
||||
1. Reload the provisioning configuration file.
|
||||
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
|
||||
The following example deletes a custom role:
|
||||
|
||||
@ -370,4 +371,4 @@ roles:
|
||||
force: true
|
||||
```
|
||||
|
||||
You can also delete a custom role using the API. Refer to the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#delete-a-custom-role" >}}) for more details.
|
||||
You can also delete a custom role using the API. Refer to the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#delete-a-custom-role" >}}) for more details.
|
||||
@ -2,6 +2,7 @@
|
||||
aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/plan-rbac-rollout-strategy/
|
||||
- /docs/grafana/latest/enterprise/access-control/usage-scenarios/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/
|
||||
description: Plan your RBAC rollout strategy before you begin assigning roles to users
|
||||
and teams.
|
||||
menuTitle: Plan your RBAC rollout strategy
|
||||
@ -11,7 +12,7 @@ weight: 20
|
||||
|
||||
# Plan your RBAC rollout strategy
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
An RBAC rollout strategy helps you determine _how_ you want to implement RBAC prior to assigning RBAC roles to users and teams.
|
||||
|
||||
@ -50,7 +51,7 @@ For example:
|
||||
|
||||
1. Map SAML, LDAP, or Oauth roles to Grafana basic roles (viewer, editor, or admin).
|
||||
|
||||
2. Use the Grafana Enterprise team sync feature to synchronize teams from your SAML, LDAP, or Oauth provider to Grafana. For more information about team sync, refer to [Team sync]({{< relref "../../../setup-grafana/configure-security/configure-team-sync/" >}}).
|
||||
2. Use the Grafana Enterprise team sync feature to synchronize teams from your SAML, LDAP, or Oauth provider to Grafana. For more information about team sync, refer to [Team sync]({{< relref "../../../../setup-grafana/configure-security/configure-team-sync/" >}}).
|
||||
|
||||
3. Within Grafana, assign RBAC permissions to users and teams.
|
||||
|
||||
@ -60,7 +61,7 @@ Consider the following guidelines when you determine if you should modify basic
|
||||
|
||||
- **Modify basic roles** when Grafana's definitions of what viewers, editors, and admins can do does not match your definition of these roles. You can add or remove permissions from any basic role.
|
||||
|
||||
> **Note:** Changes that you make to basic roles impact the role definition for all [organizations]({{< relref "../../organization-management/" >}}) in the Grafana instance. For example, when you add the `fixed:users:writer` role's permissions to the viewer basic role, all viewers in any org in the Grafana instance can create users within that org.
|
||||
> **Note:** Changes that you make to basic roles impact the role definition for all [organizations]({{< relref "../../../organization-management/" >}}) in the Grafana instance. For example, when you add the `fixed:users:writer` role's permissions to the viewer basic role, all viewers in any org in the Grafana instance can create users within that org.
|
||||
|
||||
- **Create custom roles** when fixed role definitions don't meet you permissions requirements. For example, the `fixed:dashboards:writer` role allows users to delete dashboards. If you want some users or teams to be able to create and update but not delete dashboards, you can create a custom role with a name like `custom:dashboards:creator` that lacks the `dashboards:delete` permission.
|
||||
|
||||
@ -83,7 +84,7 @@ We've compiled the following permissions rollout scenarios based on current Graf
|
||||
|
||||
1. In Grafana, create a team with the name `Internal employees`.
|
||||
1. Assign the `fixed:datasources:querier` role to the `Internal employees` team.
|
||||
1. Add internal employees to the `Internal employees` team, or map them from a SAML, LDAP, or Oauth team using [Team Sync]({{< relref "../../../setup-grafana/configure-security/configure-team-sync/" >}}).
|
||||
1. Add internal employees to the `Internal employees` team, or map them from a SAML, LDAP, or Oauth team using [Team Sync]({{< relref "../../../../setup-grafana/configure-security/configure-team-sync/" >}}).
|
||||
1. Assign the viewer role to both internal employees and contractors.
|
||||
|
||||
### Limit viewer, editor, or admin permissions
|
||||
@ -167,7 +168,7 @@ roles:
|
||||
global: true
|
||||
```
|
||||
|
||||
- Or add the following permissions to the `basic:editor` role, using provisioning or the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}):
|
||||
- Or add the following permissions to the `basic:editor` role, using provisioning or the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#update-a-role" >}}):
|
||||
|
||||
| action | scope |
|
||||
| -------------- | --------------------------- |
|
||||
@ -199,7 +200,7 @@ roles:
|
||||
|
||||
> **Note:** The `fixed:reports:writer` role assigns more permissions than just creating reports. For more information about fixed role permission assignments, refer to [Fixed role definitions]({{< relref "./rbac-fixed-basic-role-definitions/#fixed-role-definitions" >}}).
|
||||
|
||||
- Add the following permissions to the `basic:viewer` role, using provisioning or the [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}):
|
||||
- Add the following permissions to the `basic:viewer` role, using provisioning or the [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#update-a-role" >}}):
|
||||
|
||||
| Action | Scope |
|
||||
| ---------------- | ------------------------------- |
|
||||
@ -240,7 +241,7 @@ roles:
|
||||
state: 'absent'
|
||||
```
|
||||
|
||||
- Or use [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}).
|
||||
- Or use [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#update-a-role" >}}).
|
||||
|
||||
### Prevent Viewers from accessing an App Plugin
|
||||
|
||||
@ -290,4 +291,4 @@ roles:
|
||||
state: 'present'
|
||||
```
|
||||
|
||||
- Or use [RBAC HTTP API]({{< relref "../../../developers/http_api/access_control/#update-a-role" >}}).
|
||||
- Or use [RBAC HTTP API]({{< relref "../../../../developers/http_api/access_control/#update-a-role" >}}).
|
||||
@ -2,6 +2,7 @@
|
||||
aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/fine-grained-access-control-references/
|
||||
- /docs/grafana/latest/enterprise/access-control/rbac-fixed-basic-role-definitions/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
description: This topic includes a table that lists permission associated with Grafana
|
||||
fixed and basic roles.
|
||||
menuTitle: RBAC role definitions
|
||||
@ -11,7 +12,7 @@ weight: 70
|
||||
|
||||
# RBAC role definitions
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
The following tables list permissions associated with basic and fixed roles.
|
||||
|
||||
@ -87,7 +88,7 @@ The following tables list permissions associated with basic and fixed roles.
|
||||
|
||||
### Alerting roles
|
||||
|
||||
If alerting is [enabled]({{< relref "../../../alerting/migrating-alerts/opt-out/" >}}), you can use predefined roles to manage user access to alert rules, alert instances, and alert notification settings and create custom roles to limit user access to alert rules in a folder.
|
||||
If alerting is [enabled]({{< relref "../../../../alerting/migrating-alerts/opt-out/" >}}), you can use predefined roles to manage user access to alert rules, alert instances, and alert notification settings and create custom roles to limit user access to alert rules in a folder.
|
||||
|
||||
Access to Grafana alert rules is an intersection of many permissions:
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
---
|
||||
aliases:
|
||||
- /docs/grafana/latest/enterprise/access-control/rbac-provisioning/
|
||||
- /docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-provisioning/
|
||||
description: Learn about RBAC provisioning and view an example YAML provisioning file
|
||||
that configures Grafana role assignments.
|
||||
menuTitle: RBAC provisioning
|
||||
@ -10,7 +11,7 @@ weight: 60
|
||||
|
||||
# Grafana RBAC provisioning
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
|
||||
You can create, change or remove [Custom roles]({{< relref "./manage-rbac-roles/#create-custom-roles-using-provisioning" >}}) and create or remove [basic role assignments]({{< relref "./assign-rbac-roles/#assign-a-fixed-role-to-a-basic-role-using-provisioning" >}}), by adding one or more YAML configuration files in the `provisioning/access-control/` directory.
|
||||
|
||||
@ -32,7 +33,7 @@ Grafana performs provisioning during startup. After you make a change to the con
|
||||
|
||||
5. Reload the provisioning configuration file.
|
||||
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
For more information about reloading the provisioning configuration at runtime, refer to [Reload provisioning configurations]({{< relref "../../../../developers/http_api/admin/#reload-provisioning-configurations" >}}).
|
||||
|
||||
## Example role configuration file using Grafana provisioning
|
||||
|
||||
Loading…
Reference in New Issue
Block a user