diff --git a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md index 1276f049da2..5dcbb5b8ea3 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md @@ -201,23 +201,25 @@ The following list contains role-based access control actions used by Grafana Ad ### Grafana Alerting Notification action definitions -To enable these permissions, enable the `alertingApiServer` feature toggle. +To use these permissions, enable the `alertingApiServer` feature toggle. -| Action | Applicable scopes | Description | -| -------------------------------------------- | ---------------------------------- | --------------------------------------------------------------------------------------------------------------- | -| `alert.notifications.receivers:read` | `receivers:*`
`receivers:uid:*` | Read contact points. None | -| `alert.notifications.receivers.secrets:read` | `receivers:*`
`receivers:uid:*` | Export contact points with decrypted secrets.None | -| `alert.notifications.receivers:create` | None | Create a new contact points. The creator is automatically granted full access to the created contact point.None | -| `alert.notifications.receivers:write` | `receivers:*`
`receivers:uid:*` | Update existing contact points.None | -| `alert.notifications.receivers:delete` | `receivers:*`
`receivers:uid:*` | Update and delete existing contact points.None | -| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points.None | -| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points.None | -| `alert.notifications.time-intervals:read` | None | Read mute time intervals.None | -| `alert.notifications.time-intervals:write` | None | Create new or update existing mute time intervals.None | -| `alert.notifications.time-intervals:delete` | None | Delete existing time intervals.None | -| `alert.notifications.templates:read` | None | Read templates. | -| `alert.notifications.templates:write` | None | Create new or update existing templates.None | -| `alert.notifications.templates:delete` | None | Delete existing templates.None | +| Action | Applicable scopes | Description | +| -------------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------- | +| `alert.notifications.receivers:read` | `receivers:*`
`receivers:uid:*` | Read contact points. | +| `alert.notifications.receivers.secrets:read` | `receivers:*`
`receivers:uid:*` | Export contact points with decrypted secrets. | +| `alert.notifications.receivers:create` | None | Create a new contact points. The creator is automatically granted full access to the created contact point. | +| `alert.notifications.receivers:write` | `receivers:*`
`receivers:uid:*` | Update existing contact points. | +| `alert.notifications.receivers:delete` | `receivers:*`
`receivers:uid:*` | Update and delete existing contact points. | +| `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points. | +| `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points. | +| `alert.notifications.time-intervals:read` | None | Read mute time intervals. | +| `alert.notifications.time-intervals:write` | None | Create new or update existing mute time intervals. | +| `alert.notifications.time-intervals:delete` | None | Delete existing time intervals. | +| `alert.notifications.templates:read` | None | Read templates. | +| `alert.notifications.templates:write` | None | Create new or update existing templates. | +| `alert.notifications.templates:delete` | None | Delete existing templates. | +| `alert.notifications.routes:read` | None | Read notification policies. | +| `alert.notifications.routes:write` | None | Create new, update or delete notification policies | ## Scope definitions diff --git a/docs/sources/alerting/set-up/configure-rbac/_index.md b/docs/sources/alerting/set-up/configure-rbac/_index.md index 6a15d86e724..647ef8ed535 100644 --- a/docs/sources/alerting/set-up/configure-rbac/_index.md +++ b/docs/sources/alerting/set-up/configure-rbac/_index.md @@ -52,7 +52,7 @@ Grafana Alerting has the following permissions. | `alert.provisioning:write` | n/a | Update all Grafana alert rules, notification policies, etc via provisioning API. Permissions to folders and data source are not required. | | `alert.provisioning.provenance:write` | n/a | Set provisioning status for alerting resources. Cannot be used alone. Requires user to have permissions to access resources | -Contact point permissions. To enable these permissions, enable the `alertingApiServer` feature toggle. +Contact point permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle. | Action | Applicable scope | Description | | -------------------------------------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------- | @@ -64,7 +64,7 @@ Contact point permissions. To enable these permissions, enable the `alertingApiS | `receivers.permissions:read` | `receivers:*`
`receivers:uid:*` | Read permissions for contact points. | | `receivers.permissions:write` | `receivers:*`
`receivers:uid:*` | Manage permissions for contact points. | -Mute time interval permissions. To enable these permissions, enable the `alertingApiServer` feature toggle. +Mute time interval permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle. | Action | Applicable scope | Description | | ------------------------------------------- | ---------------- | -------------------------------------------------- | @@ -80,4 +80,11 @@ Notification template permissions. To enable these permissions, enable the `aler | `alert.notifications.templates:write` | n/a | Create new or update existing templates. | | `alert.notifications.templates:delete` | n/a | Delete existing templates. | +Notification policies permissions. To enable API and user interface that use these permissions, enable the `alertingApiServer` feature toggle. + +| Action | Applicable scope | Description | +| ---------------------------------- | ---------------- | ---------------------------------------------------- | +| `alert.notifications.routes:read` | n/a | Read notification policies. | +| `alert.notifications.routes:write` | n/a | Create new, update and update notification policies. | + To help plan your RBAC rollout strategy, refer to [Plan your RBAC rollout strategy](https://grafana.com/docs/grafana/next/administration/roles-and-permissions/access-control/plan-rbac-rollout-strategy/). diff --git a/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md b/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md index 2c9f3efa4db..b6bb3145053 100644 --- a/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md +++ b/docs/sources/alerting/set-up/configure-rbac/access-roles/index.md @@ -43,19 +43,19 @@ Fixed roles provide users more granular access to create, view, and update Alert Details of the fixed roles and the access they provide for Grafana Alerting are below. -| Display name in UI / Fixed role | Permissions | Description | -| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Silences Writer: `fixed:alerting.instances:writer` | All permissions from `fixed:alerting.instances:reader` and
`alert.instances:create`
`alert.instances:write` for organization scope
`alert.instances.external:write` for scope `datasources:*` | Add and update silences in Grafana and external providers. | -| Instances and Silences Reader: `fixed:alerting.instances:reader` | `alert.instances:read` for organization scope
`alert.instances.external:read` for scope `datasources:*` | Read alert instances and silences in Grafana and external providers. | -| Notifications Writer: `fixed:alerting.notifications:writer` | All permissions from `fixed:alerting.notifications:reader` and
`alert.notifications:write`for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Add, update, and delete notification policies and contact points in Grafana and external providers. | -| Notifications Reader: `fixed:alerting.notifications:reader` | `alert.notifications:read` for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Read notification policies and contact points in Grafana and external providers. | -| Rules Writer: `fixed:alerting.rules:writer` | All permissions from `fixed:alerting.rules:reader` and
`alert.rule:create`
`alert.rule:write`
`alert.rule:delete`
`alert.silences:create`
`alert.silences:write` for scope `folders:*`
`alert.rules.external:write` for scope `datasources:*` | Create, update, and delete all alert rules and manage rule-specific silences. | -| Rules Reader: `fixed:alerting.rules:reader` | `alert.rule:read`, `alert.silences:read` for scope `folders:*`
`alert.rules.external:read` for scope `datasources:*`
`alert.notifications.time-intervals:read`
`alert.notifications.receivers:list` | Read all alert rules and rule-specific silences in Grafana and external providers. | -| Full access: `fixed:alerting:writer` | All permissions from `fixed:alerting.rules:writer`
`fixed:alerting.instances:writer`
`fixed:alerting.notifications:writer` | Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers. | -| Full read-only access: `fixed:alerting:reader` | All permissions from `fixed:alerting.rules:reader`
`fixed:alerting.instances:reader`
`fixed:alerting.notifications:reader` | Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers. | -| Read via Provisioning API + Export Secrets: `fixed:alerting.provisioning.secrets:reader` | `alert.provisioning:read` and `alert.provisioning.secrets:read` | Read alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets. | -| Access to alert rules provisioning API: `fixed:alerting.provisioning:writer` | `alert.provisioning:read` and `alert.provisioning:write` | Manage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API. | -| Set provisioning status: `fixed:alerting.provisioning.status:writer` | `alert.provisioning.provenance:write` | Set provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.) | +| Display name in UI / Fixed role | Permissions | Description | +| ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Silences Writer: `fixed:alerting.instances:writer` | All permissions from `fixed:alerting.instances:reader` and
`alert.instances:create`
`alert.instances:write` for organization scope
`alert.instances.external:write` for scope `datasources:*` | Add and update silences in Grafana and external providers. | +| Instances and Silences Reader: `fixed:alerting.instances:reader` | `alert.instances:read` for organization scope
`alert.instances.external:read` for scope `datasources:*` | Read alert instances and silences in Grafana and external providers. | +| Notifications Writer: `fixed:alerting.notifications:writer` | All permissions from `fixed:alerting.routes:writer`,
`fixed:alerting.receivers:creator`,
`fixed:alerting.receivers:writer`,
`fixed:alerting.templates:writer`,
`fixed:alerting.time-intervals:writer`and
`alert.notifications:write`for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Add, update, and delete notification policies and contact points in Grafana and external providers. | +| Notifications Reader: `fixed:alerting.notifications:reader` | All permissions from `fixed:alerting.routes:reader`,
`fixed:alerting.receivers:reader`,
`fixed:alerting.templates:reader`,
`fixed:alerting.time-intervals:reader`and
`alert.notifications:read` for organization scope
`alert.notifications.external:read` for scope `datasources:*` | Read notification policies and contact points in Grafana and external providers. | +| Rules Writer: `fixed:alerting.rules:writer` | All permissions from `fixed:alerting.rules:reader` and
`alert.rule:create`
`alert.rule:write`
`alert.rule:delete`
`alert.silences:create`
`alert.silences:write` for scope `folders:*`
`alert.rules.external:write` for scope `datasources:*` | Create, update, and delete all alert rules and manage rule-specific silences. | +| Rules Reader: `fixed:alerting.rules:reader` | `alert.rule:read`, `alert.silences:read` for scope `folders:*`
`alert.rules.external:read` for scope `datasources:*`
`alert.notifications.time-intervals:read`
`alert.notifications.receivers:list` | Read all alert rules and rule-specific silences in Grafana and external providers. | +| Full access: `fixed:alerting:writer` | All permissions from `fixed:alerting.rules:writer`
`fixed:alerting.instances:writer`
`fixed:alerting.notifications:writer` | Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers. | +| Full read-only access: `fixed:alerting:reader` | All permissions from `fixed:alerting.rules:reader`
`fixed:alerting.instances:reader`
`fixed:alerting.notifications:reader` | Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers. | +| Read via Provisioning API + Export Secrets: `fixed:alerting.provisioning.secrets:reader` | `alert.provisioning:read` and `alert.provisioning.secrets:read` | Read alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets. | +| Access to alert rules provisioning API: `fixed:alerting.provisioning:writer` | `alert.provisioning:read` and `alert.provisioning:write` | Manage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API. | +| Set provisioning status: `fixed:alerting.provisioning.status:writer` | `alert.provisioning.provenance:write` | Set provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.) | If you have enabled the `alertingApiServer` feature toggle, an additional set of fixed roles is available. @@ -68,6 +68,8 @@ If you have enabled the `alertingApiServer` feature toggle, an additional set of | Templates Writer: `fixed:alerting.templates:writer` | `alert.notifications.templates:read`, `alert.notifications.templates:write`, `alert.notifications.templates:delete` | Create new and manage existing notification templates. | | Time Intervals Reader: `fixed:alerting.time-intervals:reader` | `alert.notifications.time-intervals:read` | Read all time intervals. | | Time Intervals Writer: `fixed:alerting.time-intervals:writer` | `alert.notifications.time-intervals:read`, `alert.notifications.time-intervals:write`, `alert.notifications.time-intervals:delete` | Create new and manage existing time intervals. | +| Notification Policies Reader: `fixed:alerting.routes:reader` | `alert.notifications.routes:read` | Read all time intervals. | +| Notification Policies Writer: `fixed:alerting.routes:writer` | `alert.notifications.routes:read` `alert.notifications.routes:write` | Create new and manage existing time intervals. | ## Create custom roles