Manage account roles

YugabyteDB Aeon uses role-based access control (RBAC) to manage access to your YugabyteDB Aeon organization and accounts. Using roles, you can enforce the principle of least privilege (PoLP) by ensuring that users have the precise permissions needed to fulfill their roles while mitigating the risk of unauthorized access or accidental breaches. A role defines a set of permissions that determine what features can be accessed by account users who have been assigned that role.

Organization roles

Your organization has two roles: Super Admin and Member.

Organization Super Admins can switch between all accounts and access organization settings. Super Admins are also added to all accounts as an Admin, and this role can't be changed.

Each user you add to individual accounts is added to your organization as a Member. Members can switch between accounts they have joined.

For information on managing organization roles, see Manage organization users and authentication.

Account roles

Each account in your organization has its own access and role management. A single user can be a member of multiple accounts simultaneously, with a different role in each account. Each account remains fully isolated.

Accounts include built-in roles, and you can define custom roles for team members to restrict access to specific account features. For information on assigning roles to users, refer to Change a user's role.

Roles are also assigned to API keys to delineate what functionality is available to users accessing an account using either the YugabyteDB Aeon API or CLI. You assign roles to API keys when creating the key; refer to Create an API key.

The Roles tab displays a list of roles that are defined for your account, including the role name, description, type, the number of users assigned the role, and the number of API keys created for the role.

To view role details, select the role in the list.

Built-in account roles

YugabyteDB Aeon includes built-in roles for managing accounts:

• Admin - The Admin role provides full access to all features. There must always be at least one Admin user. The primary account user (the user who created the YugabyteDB Aeon account) is automatically assigned an Admin role.

  Organization Super Admin users are automatically granted Admin on every account in your organization.

• Developer - The Developer role provides access to all account features, with the exception of the following administrative tasks:

  • invite users
  • delete or change the role of other users
  • change login methods
  • create or revoke API keys
  • manage plans and billing
  • view account activity

• Viewer - The Viewer role has all view permissions, exclusively, and can't perform any tasks.

You can't delete or edit built-in roles.

Create a role

To create a custom role for an account, in the account where you want to change roles, do the following:

1. Navigate to Security > Access Control > Roles, then click Create a Role to display the Create a Role dialog.
2. Enter a name for the role.
3. Enter a description for the role.
4. Click Select Permissions.
5. Select the permissions to assign to the role and click Select when you are done.
6. Click Save.

To create a custom role from an existing role, do the following:

1. Navigate to Security > Access Control > Roles, then select the role to clone to display the Role Details sheet.
2. For a built-in role, click Clone Role; for a custom role, click Actions and choose Clone Role.
3. Enter a name for the role.
4. Enter a description for the role.
5. Click Edit Permissions.
6. Select the permissions to assign to the role and click Select when you are done.
7. Click Save.

Edit a role

You can only edit custom roles. To edit a custom role, do the following:

1. Navigate to Security > Access Control > Roles, then select the custom role to modify to display the Role Details sheet.
2. Click Actions and Edit Role.
3. Edit the name of the role.
4. Edit the description of the role.
5. Click Edit Permissions.
6. Select the permissions to assign to the role and click Select when you are done.
7. Click Save.

Delete a role

You can only delete custom roles, and only if the role is not assigned to any users.

To delete a custom role, do the following:

1. Navigate to Security > Access Control > Roles, then select the custom role to delete to display the Role Details sheet.
2. Click Actions and Delete Role.
3. Enter the role name and click Delete Role.