Predefined IAM roles on CloudFerro Cloud

A developer who works with notebooks, an engineer who manages Kubernetes clusters, and a colleague who reviews service status need different permissions. Predefined IAM roles describe the actions each person can perform in a service. Assigning a suitable combination to an IAM group lets you manage access for people who share the same responsibilities.

The examples below follow several hypothetical teams in an organization building an environmental monitoring service. Each team’s work leads to a role combination, with the catalogue of 41 predefined roles available for checking the exact permissions and limitations.

Prerequisites

No. 1 Access to My Portal in the intended organization

The examples assume that you are signed in to My Portal with the intended organization selected. New users can begin with account setup and Register or join an organization in My Portal on CloudFerro Cloud to prepare their account and join or register an organization.

No. 2 Permission to inspect roles and manage the example assignments

Your account needs access to IAM → Roles for the role review described in Roles: review and create access rules on CloudFerro Cloud. Putting a team example into practice also requires permission to create groups, assign roles, and manage membership, following Groups: organize users and service accounts on CloudFerro Cloud. An organization administrator can handle assignments that your account cannot manage.

No. 3 A team and a clear list of its tasks

The team’s responsibilities determine which roles fit. A short task list should name the services and resources involved and distinguish viewing information from developing applications, managing credentials, or creating and deleting resources. The member names or email addresses can be checked in Users: find organization members on CloudFerro Cloud so that the role combination is assigned to the intended people.

Start with the team’s work

In this example, the organization collects observations, develops flood models, and sends alerts when conditions change. Its teams share the platform, but each takes responsibility for a different part of the service. The team and group names below are hypothetical; the permissions come from the predefined roles in the catalogue.

MK8s developers (RiverApplications). These developers need kubeconfig access to existing Kubernetes clusters and visibility into the container registry. A group combining ManagedKubernetesMemberPlus and RegistryViewer covers those two access needs. The kubeconfig access also permits backup changes through kubectl. A colleague who only checks cluster status through the GUI can use the ContainerPlatformReviewer combination instead.

Machine Learning team (FloodModels). The team coordinates work in an assigned Kubeflow namespace and reviews MLflow and registry resources. The MLNamespaceOperator combination lets it manage the namespace’s quotas, users, and kubeconfig, with viewer access to AI Experiments and Registry. Creating Kubeflow clusters or namespaces remains outside this combination; so does administering MLflow clusters, tenants, or users.

Managed Notebooks developers (NotebookLab). These colleagues create notebooks for exploring observations and suspend them when their work is finished. NotebookAndExperimentOperator combines that notebook lifecycle work with read-only access to MLflow service resources. Its ManagedNotebooksAdmin component grants full control over Managed Notebooks, including deletion.

Event-driven application team (RiverAlerts). This team maintains functions, adjusts which networks can connect to brokers, and manages messaging users and credentials. EventDrivenDeveloper brings those permissions together for existing brokers and messaging accounts. When a new broker or messaging account is needed, a separate provisioning team can use MessagingProvisioner to create it.

Release engineers (FunctionReleases). The release team builds, deploys, tests, and rolls back versions of existing functions, and inspects registry contents. FunctionReleaseOperator matches those duties. It includes downloading function source code, but does not allow the team to create or delete namespaces, functions, or integrations.

Operations support team (PlatformSupport). Support colleagues need to inspect resources across Functions, Registry, Message Broker, Message Streaming, and Workflows when investigating a report. PlatformReadOnly combines the five viewer roles for that work. Functions source-code downloads and Message Streaming credentials remain outside the access provided by this combination.

An IAM group can hold the shared role list for people with the same responsibilities. Its name describes the group’s purpose; the assigned roles determine access. A full review also includes each member’s Direct Roles and Roles via Groups, which may contain other assignments.

Example access profiles

The 14 combinations below turn tasks such as reviewing services, releasing functions, or managing messaging access into a role list. Their names are suggestions for your own access profiles or groups. For example, RiverAlerts can use the roles listed under EventDrivenDeveloper; there is no need for the team name and the combination name to match.

Each entry combines predefined roles that can be assigned through a group.

PlatformReadOnly
FunctionsViewer + RegistryViewer + MessageBrokerViewer + MessageStreamingViewer + WorkflowsViewer	Give a support team visibility across five services.
FunctionReleaseOperator
FunctionsDeployer + RegistryViewer	Build, deploy, test, and roll back existing function versions while inspecting registry contents.
FunctionAndRegistryDeveloper
FunctionsDeveloper + RegistryDeveloper	Develop functions and manage registry tokens and repository cleanup.
AccessAuditReader
IamViewer + FunctionsViewer + RegistryViewer	Review IAM configuration alongside Functions and Registry resources.
EventDrivenDeveloper
FunctionsDeveloper + MessageBrokerDeveloper + MessageStreamingDeveloper	Develop functions, adjust broker connection ranges, and manage messaging users and credentials.
MessagingProvisioner
MessageBrokerProvisioner + MessageStreamingProvisioner	Create and delete brokers and messaging accounts for other teams.
MessagingAccessOperator
MessageBrokerDeveloper + MessageStreamingDeveloper	Maintain broker connection ranges and messaging-user access in existing environments.
AutomationCredentialsOperator
MessageStreamingUserOperator + RegistryAccessTokenOperator	Let automation retrieve messaging credentials and inspect or rotate its own registry token.
MLPlatformReviewer
AIExperimentsViewer + MLOpsStudioViewer + WorkflowsViewer	Review MLflow, Kubeflow, and Airflow service resources. MLOpsStudioViewer includes kubeconfig access.
MLNamespaceOperator
MLOpsStudioNamespaceManager + AIExperimentsViewer + RegistryViewer	Manage an assigned Kubeflow namespace while reviewing MLflow and registry resources.
WorkflowAndFunctionOperator
WorkflowsAdmin + FunctionsDeployer	Manage Airflow clusters and users, and release function versions.
ContainerPlatformReviewer
ManagedKubernetesMember + RegistryViewer	Inspect Kubernetes cluster status through the GUI and review registry contents.
NotebookAndExperimentOperator
ManagedNotebooksAdmin + AIExperimentsViewer	Manage notebooks and review MLflow shared clusters, tenants, and users.
TenantSupportOperator
TenantManagerMember + IamViewer	Combine basic tenant-service access with read-only IAM access.

Predefined roles by service

The catalogue summarizes each role’s permissions and limitations. The details in IAM → Roles let you compare its resource scopes and actions with the team’s needs before assignment, including access to credentials and permission to delete resources.

AI Experiments

Role	Description
AIExperimentsAdmin	Full control over MLflow shared clusters, tenants, and users.
AIExperimentsViewer	Read-only access to MLflow shared clusters, tenants, and users.

Functions

Role	Description
FunctionsAdmin	Full access to Functions. Manage namespaces, functions, versions, builds and integrations, including connection tests. For administrators responsible for the whole service.
FunctionsDeployer	Build, deploy, test and roll back function versions, including downloading source code. Cannot create or delete namespaces, functions or integrations. Intended for CI/CD pipelines and automation accounts.
FunctionsDeveloper	Create and manage namespaces, functions, versions and integrations across their full lifecycle. Does not include connection tests or administrative actions.
FunctionsViewer	View namespaces, functions, versions, builds and integrations without making changes. Cannot download source code. For auditors, support teams and stakeholders.

Identity and Access Management

Role	Description
IamAdmin	Administrative access to IAM.
IamViewer	Read-only access to IAM.

Managed Kubernetes

Role	Description
ManagedKubernetesAdmin	Create, read, update, and delete (CRUD) the tenant’s MK8s clusters, nodepools, and cluster backups. Access all organization clusters using kubeconfig files downloaded from the MK8s panel.
ManagedKubernetesMember	View the state of the tenant’s clusters through the read-only MK8s graphical interface.
ManagedKubernetesMemberPlus	Access the tenant’s clusters using kubeconfig files downloaded from the MK8s panel. The role description excludes CRUD operations on clusters, nodepools, and backups. Warning: With kubeconfig, a user can also modify backups directly using kubectl.

Managed Notebooks

Role	Description
ManagedNotebooksAdmin	Full control over Managed Notebooks, including creating and deleting notebooks, as well as launching, opening, and suspending them.

Message Broker

Role	Description
MessageBrokerAdmin	Full access to Message Broker. Create, update and delete brokers, and control which IP ranges can connect to them. For administrators responsible for the whole service.
MessageBrokerDeveloper	View brokers and change which IP ranges (CIDR) can connect to them. Cannot create or delete brokers.
MessageBrokerProvisioner	Create and delete brokers, and view their details, available versions and sizes. Cannot change allowed IP ranges on existing brokers. For teams that set up environments for others.
MessageBrokerViewer	View brokers, available versions and sizes without making changes. For auditors, support teams and stakeholders.

Message Streaming

Role	Description
MessageStreamingAdmin	Full access to Message Streaming. Create and delete messaging accounts, and manage messaging users and their credentials. For administrators responsible for the whole service.
MessageStreamingDeveloper	Create and delete messaging users and download their credentials within existing messaging accounts. Cannot create or delete accounts.
MessageStreamingProvisioner	Create and delete messaging accounts. Cannot manage messaging users or access credentials. For teams that set up environments for others.
MessageStreamingUserOperator	A narrow CI/CD role for reading a Message Streaming user and downloading credentials.
MessageStreamingViewer	View messaging accounts and users without making changes. Cannot view or download credentials. For auditors, support teams and stakeholders.

MLOps Studio

Role	Description
MLOpsStudioAdmin	Full control over Kubeflow: create and delete clusters and namespaces, manage all Kubeflow resources.
MLOpsStudioNamespaceManager	Manage an assigned Kubeflow namespace: quotas, users, and kubeconfig. Cannot create or delete clusters or namespaces.
MLOpsStudioViewer	Read-only access to Kubeflow clusters, namespaces, users, and kubeconfig.

OpenStack

Role	Description
OpenstackCreator	Create new resources, including virtual machines, volumes, and networks, within a project.
OpenstackDomainAdmin	Full administrative access across the OpenStack domain.
OpenstackHeatStackOwner	Manage Heat orchestration stacks within a project.
OpenstackLoadBalancerMember	Manage and configure load balancers within a project.
OpenstackMagnumUser	Manage Magnum container infrastructure services.
OpenstackMember	Standard project member access to manage and use cloud resources.
OpenstackReader	Read-only access to view domain resources without modification rights. The description includes the qualification “limited Regions for member Group”; it does not identify the affected regions.

Registry

Role	Description
RegistryAccessTokenOperator	Narrow non-human role for CI/CD pipelines or platform components that need to inspect and self-rotate their own access token credentials.
RegistryAdmin	Full control over a project including creation and deletion.
RegistryDeveloper	Full read access plus access token management and repository cleanup. Suitable for developers and DevOps engineers managing CI/CD credentials within a project.
RegistryViewer	Read-only access to a project and its contents. Suitable for auditors, security reviewers, and developers who only consume images.

Sherlock

Role	Description
SherlockAdmin	Administrator role for the Sherlock service.
SherlockMember	Member role for the Sherlock service.

Billing and Tenant Services

Role	Description
TenantManagerAdmin	Administrator role for Billing and Tenant Services, including access to organization details, invitations, invoices, wallets, and accounts.
TenantManagerMember	Member role for Billing and Tenant Services, including basic access to tenant activities.

Workflows

Role	Description
WorkflowsAdmin	Full control over Airflow clusters and users.
WorkflowsViewer	Read-only access to Airflow clusters and users.

What to do next

A shared team role list fits the group workflow, while an individual assignment can be made through the user workflow. After assignment, the member’s role details provide a place to review the assigned roles.

• Assign roles to a user on CloudFerro Cloud

• Groups: organize users and service accounts on CloudFerro Cloud

• Roles: review and create access rules on CloudFerro Cloud

• Service accounts: create credentials and assign roles on CloudFerro Cloud

Still need help?

If this article doesn’t answer all of your questions, our support team will do their best to help you.

Contact support

Jump to

• Predefined IAM roles on CloudFerro Cloud
  • Prerequisites
  • Start with the team’s work
  • Example access profiles
  • Predefined roles by service
    • AI Experiments
    • Functions
    • Identity and Access Management
    • Managed Kubernetes
    • Managed Notebooks
    • Message Broker
    • Message Streaming
    • MLOps Studio
    • OpenStack
    • Registry
    • Sherlock
    • Billing and Tenant Services
    • Workflows
  • What to do next

↑