Access and permissions
The Cloud Console features a rudimentary permissions system based on hardcoded groups, usually a “Admins” and a “Members” group where the “Admins” group can be considered “RW” (read and write) and the “Members” group can be considered read only.
Generally these groups and their permissions are limited to activity in the Cloud Console and do not extend to underlying systems like DBaaS and OpenStack.
It is usually possible to manage permissions with the native model for the product in question, ie. OpenStack project roles
Organization
Organization admins can manage permissions through the “Organization” page in the sidebar. Minimum permissions in an organization is represented by the “Members” group. They can view everything for the organization in Cloud Console.
Admins can edit everything owned by the organization in the Cloud Console and make other users Admins in the organization.
DBaaS
For each DBaaS project, there is a “Admins” and a “Members” group. Their privileges in DBaaS are the same, ie. complete.
In the Cloud Console organization Admins can:
- Create projects
- Add/remove users for each project
OpenStack
For OpenStack projects, organization Admins can:
- Create projects
- Add/remove users for each project
- Manage users’ Openstack project roles for each project