-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Better explanation of Managed vs Custom roles? #31793
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -48,18 +48,20 @@ Preview mode gives your organization's administrators the ability to opt into ce | |
|
||
By default, existing users are associated with one of the three managed roles: | ||
|
||
- Datadog Admin | ||
- Datadog Standard | ||
- Datadog Read Only | ||
- Datadog Admin Role | ||
- Datadog Standard Role | ||
- Datadog Read Only Role | ||
|
||
All users with one of these roles can read all data types, except for [individually read-restricted][1] resources. Admin and Standard users have write permissions on assets. Admin users have additional read and write permissions for sensitive assets relating to user management, org management, billing, and usage. | ||
All users with one of these roles can read data, except for [individually read-restricted][1] resources. Admin and Standard users have write permissions on assets. Admin users have additional read and write permissions for sensitive assets relating to user management, org management, billing, and usage. | ||
|
||
Managed roles are created and maintained by Datadog. Their permissions may be automatically updated by Datadog as new features are added or permissions change. Users cannot modify managed roles directly, but they can clone them to create [custom roles](#custom-roles) with specific permissions. If necessary, users can delete managed roles from their account. | ||
|
||
### Custom roles | ||
|
||
Create a custom role to combine permissions into new roles. A custom role gives you the ability to define a persona, for example, a billing administrator, and then assign the appropriate permissions for that role. After creating a role, assign or remove permissions to this role directly by [updating the role in Datadog][2], or through the [Datadog Permission API][3]. | ||
|
||
Unlike Managed Roles, custom roles do not receive new permissions when Datadog releases new products and features. Custom roles only receive new permissions to maintain compatibility when Datadog releases a new permission gating existing functionality. | ||
|
||
**Note**: When adding a new custom role to a user, make sure to remove the managed Datadog role associated with that user to enforce the new role permissions. | ||
|
||
## Permissions list | ||
|
@@ -79,4 +81,4 @@ Each managed role inherits all of the permissions from the less powerful roles. | |
|
||
[1]: /account_management/rbac/granular_access | ||
[2]: /account_management/users/#edit-a-user-s-roles | ||
[3]: /api/latest/roles/#list-permissions | ||
[3]: /api/latest/roles/#list-permissions | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I didn't mean to change this line. Might be the change of a newline at the end of the file? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, a change in the newline at the end of the file is the most likely reason GitHub highlights this line, since the text is the same. |
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This seemed misleading to me. Read Only Role cannot read Audit Trail, for example. Read Only role grants only read access but does not grant ALL read data accesses.