Permissions Reference¶

This page lists every permission in edgeContinuum, grouped by the part of the console it controls. Use it to build roles, to work out which permission someone is missing, or to check what a role really grants. The console has the same catalog: click Permission reference in an organization's Roles tab, or Open the permission reference in the role editor.

How grants, roles and groups combine, and how organization access reaches projects, is explained in Users, Groups and Permissions.

How to read the tables¶

Scope: Org permissions can be granted only on the organization and never apply inside a project. Org/Project permissions can be granted on the organization, where they apply in every current and future project, or on a single project. A role that contains even one Org permission can only be assigned on the organization (the console marks it Organization only).
Implied by: holding the parent permission listed here gives you this one too. — means you grant it explicitly.

Permission implication¶

Some permissions are implied by a broader one. Anyone who holds the parent automatically holds the child, at the same scope. For example, mvms_update implies every fine-grained virtual machine change:

mvms_update
  ├─ mvms_power_update              (start, stop)
  ├─ mvms_resize_update             (resize)
  ├─ mvms_network_attachment_update (attach/detach networks)
  ├─ mvms_monitoring_update         (monitoring on/off)
  ├─ mvms_metadata_update           (rename, description)
  └─ mvms_action_update             (cancel/sync operations)

Grant the parent to someone who owns a resource end to end, or only a child for a narrower job, such as an on-call rotation that may start and stop virtual machines but never resize or delete them. Holding a child never grants its parent or its siblings.

Reads split the same way. A <resource>_get permission is a read bundle: it implies a <resource>_metadata_get child that covers only the plain details, plus separate children for reads that expose credentials or metrics:

mks_get
  ├─ mks_metadata_get    (cluster, node pools, nodes, versions, action history)
  ├─ mks_kubeconfig_get  (kubeconfig download, carries credentials)
  └─ mks_metrics_get     (cluster and node metrics)

Grant mks_metadata_get on its own when someone needs to see a cluster but must not download its kubeconfig. Regions, zones, infrastructures, service configs, Kubernetes clusters, virtual machines, PostgreSQL instances, networks, routers, firewalls and SSH keys all have a _metadata_get child, and all of them except SSH keys have a _metadata_update child for renaming the resource or editing its description.

Standalone permissions

Import, detach, ownership (_authority_update), Read-only/Managed control (_control_update), sharing and backup permissions are never implied by _update or _delete. Delete and detach are independent: holding one never gives you the other.

Credential-bearing reads¶

mks_kubeconfig_get, postgresql_instance_connection_get, mvms_console_get, mvms_logs_get and mvms_cloudinit_get can expose working credentials. They are implied by the matching _get bundle.

Role templates include credential-bearing reads

The console's Viewer, Developer and Network admin role templates include these reads. For a read-only role that must not see secrets, remove these reads and the _get bundles that imply them, and keep the _metadata_get and _list permissions.

What project members typically need¶

Most resource permissions can be granted per project, but the create and import forms also read organization-level information. Someone whose access comes only from project grants can open these forms but can't fill them in until they also hold these permissions on the organization:

To...	They also need, on the organization
Create a virtual machine, Kubernetes cluster, PostgreSQL instance, network, router, firewall or SSH key	`region_list`, `zone_list` and `infra_list` (to pick the region, zone and infrastructure)
Import any resource	`infra_list` and `infra_get` (to pick the infrastructure and browse your cloud account)
Create a virtual machine or Kubernetes cluster, add a node pool or resize a control plane	`infra_get` (to read the infrastructure's sizes, images and Kubernetes versions)
Create a Kubernetes cluster or PostgreSQL instance	`service_config_list` and `service_config_metadata_get` (or `service_config_get`)

The PostgreSQL create and resize forms also load the available tiers, sizes and versions, which needs postgresql_instance_metadata_get (or postgresql_instance_get) in the project.

All the organization permissions above are Org-only, so a role containing them can only be assigned on the organization. Keep them in a small separate role (for example Project creator basics) that you assign on the organization alongside the project grants. They let people see the organization's regions, zones, infrastructures and service configs, but not change them. The Project admin role template picks only permissions that can be granted in a project, so it does not include them.

Organization and access permissions¶

These permissions cover the Organizations & projects and Quotas pages: organizations, projects, members, groups, roles, grants and quota.

Organizations¶

Permission	Scope	Implied by	Description
`resourcemanager_organization_get`	Org	—	View the organization's details
`resourcemanager_organization_update`	Org	—	Rename the organization

Projects¶

Permission	Scope	Implied by	Description
`resourcemanager_project_create`	Org	—	Create a project in the organization
`resourcemanager_project_get`	Org/Project	—	View a project's details
`resourcemanager_project_list`	Org/Project	—	List projects: every project when granted on the organization, otherwise the projects where it is granted
`resourcemanager_project_update`	Org/Project	—	Rename a project

Organization members¶

People join an organization only by invitation. Pending invitations appear as rows in the Members tab.

Permission	Scope	Implied by	Description
`resourcemanager_organization_member_add`	Org	—	Invite people to the organization, and cancel invitations you sent
`resourcemanager_organization_member_get`	Org	—	View an organization member
`resourcemanager_organization_member_list`	Org	—	List the organization's members and pending invitations
`resourcemanager_organization_member_remove`	Org	—	Remove a member from the organization, or cancel an invitation someone else sent

Groups¶

Groups are defined in the organization. You can grant them roles and permissions on the organization and in individual projects.

Permission	Scope	Implied by	Description
`resourcemanager_group_create`	Org	—	Create a group
`resourcemanager_group_get`	Org	—	View a group's details
`resourcemanager_group_list`	Org	—	List the organization's groups
`resourcemanager_group_update`	Org	—	Rename a group
`resourcemanager_group_delete`	Org	—	Delete a group
`resourcemanager_group_user_add`	Org	—	Add a member to a group
`resourcemanager_group_user_delete`	Org	—	Remove a member from a group

Roles¶

Named roles belong to the organization and can be assigned on the organization or, if they contain no Org-only permission, inside projects.

Permission	Scope	Implied by	Description
`resourcemanager_organization_role_create`	Org	—	Create a named role
`resourcemanager_organization_role_list`	Org	—	List the organization's named roles
`resourcemanager_organization_role_get`	Org	—	View a named role and the permissions it grants
`resourcemanager_organization_role_update`	Org	—	Rename a role or change its permissions. The change reaches everyone who holds it immediately
`resourcemanager_organization_role_delete`	Org	—	Delete a role. Refused while any member or group still holds it, on the organization or in any project

Organization permission grants¶

These permissions control who can grant access on the organization. Treat them as administrative: anyone holding them can widen their own team's access.

Permission	Scope	Implied by	Description
`resourcemanager_organization_user_role_grant`	Org	—	Grant organization-level roles or permissions to a user, including assigning a single role
`resourcemanager_organization_user_role_revoke`	Org	—	Revoke a user's organization-level grant, or take a single role off them
`resourcemanager_organization_user_role_update`	Org	—	Change the organization-level roles and permissions granted to a user
`resourcemanager_organization_user_role_get`	Org	—	View the organization-level roles and permissions granted to a user
`resourcemanager_organization_user_role_list`	Org	—	List the organization-level grants of all users
`resourcemanager_organization_group_role_grant`	Org	—	Grant organization-level roles or permissions to a group, including assigning a single role
`resourcemanager_organization_group_role_revoke`	Org	—	Revoke a group's organization-level grant, or take a single role off it
`resourcemanager_organization_group_role_update`	Org	—	Change the organization-level roles and permissions granted to a group
`resourcemanager_organization_group_role_get`	Org	—	View the organization-level roles and permissions granted to a group
`resourcemanager_organization_group_role_list`	Org	—	List the organization-level grants of all groups

Project permission grants¶

Permission	Scope	Implied by	Description
`resourcemanager_project_user_role_grant`	Org/Project	—	Grant project roles or permissions to a user, including assigning a single role
`resourcemanager_project_user_role_revoke`	Org/Project	—	Revoke a user's project grant, or take a single role off them
`resourcemanager_project_user_role_update`	Org/Project	—	Change the project roles and permissions granted to a user
`resourcemanager_project_user_role_get`	Org/Project	—	View the project roles and permissions granted to a user
`resourcemanager_project_user_role_list`	Org/Project	—	List the project grants of all users
`resourcemanager_project_group_role_grant`	Org/Project	—	Grant project roles or permissions to a group, including assigning a single role
`resourcemanager_project_group_role_revoke`	Org/Project	—	Revoke a group's project grant, or take a single role off it
`resourcemanager_project_group_role_update`	Org/Project	—	Change the project roles and permissions granted to a group
`resourcemanager_project_group_role_get`	Org/Project	—	View the project roles and permissions granted to a group
`resourcemanager_project_group_role_list`	Org/Project	—	List the project grants of all groups

Limits that apply to every grant

Org-only permissions never apply inside a project, so project grants offer only Org/Project permissions and roles. Only an organization administrator can grant or take away OrganizationAdmin, and its all_permissions grant can't be given any other way. See Organization Administrator.

Quota¶

Permission	Scope	Implied by	Description
`resourcemanager_organization_quota_get`	Org	—	View the organization's quota limits and current usage
`resourcemanager_organization_quota_profile_get`	Org	—	View the organization's quota profile on its own. The Quotas page doesn't need it

Infrastructure permissions¶

These permissions cover the INFRASTRUCTURE pages: regions, zones, infrastructures, their image and flavor catalogs, and the service configs that offer managed services. Most can be granted only on the organization; the image and flavor reads can also be granted in a project.

Regions¶

Permission	Scope	Implied by	Description
`region_create`	Org	—	Create a region
`region_get`	Org	—	Full read access to a region. Implies `region_metadata_get`
`region_list`	Org	—	List regions
`region_update`	Org	—	Update a region. Implies `region_metadata_update`
`region_delete`	Org	—	Delete a region
`region_metadata_get`	Org	`region_get`	View a region's details
`region_metadata_update`	Org	`region_update`	Rename a region or edit its description

Zones¶

Permission	Scope	Implied by	Description
`zone_create`	Org	—	Create a zone
`zone_get`	Org	—	Full read access to a zone. Implies `zone_metadata_get`
`zone_list`	Org	—	List zones
`zone_update`	Org	—	Update a zone. Implies `zone_metadata_update`
`zone_delete`	Org	—	Delete a zone
`zone_metadata_get`	Org	`zone_get`	View a zone's details
`zone_metadata_update`	Org	`zone_update`	Rename a zone or edit its description

Infrastructures¶

Permission	Scope	Implied by	Description
`infra_create`	Org	—	Create an infrastructure, including the credential check and the preview of the cloud's flavors, images and capabilities before it exists
`infra_get`	Org	—	Full read access to an infrastructure: live discovery of what exists in your cloud account (used by import forms), its Kubernetes versions, and access to its flavor and image catalogs. Implies `infra_metadata_get`
`infra_list`	Org	—	List infrastructures
`infra_update`	Org	—	Update an infrastructure. Implies every fine-grained infrastructure permission below, plus the image and flavor import and update permissions
`infra_delete`	Org	—	Delete an infrastructure
`infra_metadata_get`	Org	`infra_get`	View an infrastructure's details, capabilities, dependents and action history, without live discovery
`infra_credentials_update`	Org	`infra_update`	Rotate the credentials used to reach the infrastructure provider (Update Credentials)
`infra_action_update`	Org	`infra_update`	Run cancel or sync actions on infrastructure operations
`infra_storage_update`	Org	`infra_update`	Edit the storage configuration (Edit Storage): offered volume types and the default volume type
`infra_network_config_update`	Org	`infra_update`	Edit the network configuration (Edit Network & Load Balancing): DNS nameservers and the load balancer provider
`infra_metadata_update`	Org	`infra_update`	Rename an infrastructure or edit its description (Edit)

Images¶

Reading the image and flavor catalogs has two layers:

infra_get on the organization lets people reach an infrastructure's catalog and see its public entries.
image_get, image_list, flavor_get and flavor_list decide who also sees access-restricted entries. Granted on the organization, they show every entry. Granted in a project, they show the entries whose project access includes that project.

Creating a virtual machine or cluster from an entry checks the entry's project access against the project the resource is created in.

Permission	Scope	Implied by	Description
`image_get`	Org/Project	—	View access-restricted images
`image_list`	Org/Project	—	List access-restricted images
`image_import`	Org	`infra_update`	Import images from the provider into the catalog
`image_update`	Org	`infra_update`	Edit imported images (name, description, enabled, project access) or remove them from the catalog. VM backups use `mvms_snapshot_update` and `mvms_snapshot_delete`

Flavors¶

Permission	Scope	Implied by	Description
`flavor_get`	Org/Project	—	View access-restricted flavors
`flavor_list`	Org/Project	—	List access-restricted flavors
`flavor_import`	Org	`infra_update`	Import flavors from the provider into the catalog
`flavor_update`	Org	`infra_update`	Edit flavors (name, description, enabled, project access) or remove them from the catalog

Service configs¶

A service config groups the services that an infrastructure offers. In the console each service is a Kubernetes clusters or PostgreSQL databases setup inside the service config; the permission names call these setups service platforms.

Setting up a service (Set up) needs service_config_create, and deleting a setup (Delete setup) needs service_config_delete.
Upgrading a platform, offering or withdrawing it and managing PostgreSQL tiers need the service_platform_* permissions, all implied by service_config_update.
service_config_update is also the only permission that reaches the Kubernetes clusters the platform creates for Fully managed PostgreSQL. Those clusters belong to the organization rather than to a project.

Permission	Scope	Implied by	Description
`service_config_create`	Org	—	Create a service config, or set up a service on one
`service_config_get`	Org	—	Full read access to a service config. Implies `service_config_metadata_get`
`service_config_list`	Org	—	List service configs
`service_config_update`	Org	—	Update a service config and its platforms, and access the clusters behind Fully managed PostgreSQL. Implies `service_config_metadata_update` and `service_platform_update`
`service_config_delete`	Org	—	Delete a service config, or delete a service setup from one
`service_config_metadata_get`	Org	`service_config_get`	View a service config and its platforms, including storage classes, PostgreSQL tiers, the instances using a tier, and platform action history
`service_config_metadata_update`	Org	`service_config_update`	Rename a service config or edit its description
`service_platform_update`	Org	`service_config_update`	Manage a service platform. Implies the upgrade, enable and tier permissions below
`service_platform_upgrade_update`	Org	`service_platform_update`	Upgrade a service platform
`service_platform_enabled_update`	Org	`service_platform_update`	Offer a service to users or stop offering it (Offer to users / Stop offering)
`service_platform_tier_update`	Org	`service_platform_update`	Add or remove the PostgreSQL tiers a platform offers

Managed services and virtual machines permissions¶

These permissions cover Kubernetes clusters, PostgreSQL instances (MANAGED SERVICES) and virtual machines (COMPUTE & NETWORK). Each has coarse lifecycle permissions, plus fine-grained children for individual day-2 operations and for reads that expose credentials or metrics. In permission names, mks stands for Kubernetes clusters and mvms for virtual machines.

Kubernetes clusters¶

Permission	Scope	Implied by	Description
`mks_create`	Org/Project	—	Create a Kubernetes cluster, or add a node pool to one
`mks_get`	Org/Project	—	Full read access to a cluster. Implies the metadata, kubeconfig and metrics reads below
`mks_list`	Org/Project	—	List clusters
`mks_update`	Org/Project	—	Update a cluster. Implies every day-2 cluster operation below
`mks_delete`	Org/Project	—	Delete a cluster or one of its node pools
`mks_metadata_get`	Org/Project	`mks_get`	View a cluster, its node pools and nodes, its upgrade versions and its action history, without the kubeconfig
`mks_kubeconfig_get`	Org/Project	`mks_get`	Download the cluster kubeconfig, which carries cluster credentials
`mks_metrics_get`	Org/Project	`mks_get`	Read cluster and node metrics
`mks_action_update`	Org/Project	`mks_update`	Run cancel or sync actions on cluster and node pool operations
`mks_controlplane_upgrade_update`	Org/Project	`mks_update`	Upgrade the control plane Kubernetes version
`mks_controlplane_resize_update`	Org/Project	`mks_update`	Resize the control plane: compute flavor and/or replica count
`mks_csi_update`	Org/Project	`mks_update`	Manage the cluster CSI (storage) configuration
`mks_nodepool_scale_update`	Org/Project	`mks_update`	Scale a node pool
`mks_nodepool_upgrade_update`	Org/Project	`mks_update`	Upgrade a node pool's Kubernetes version
`mks_monitoring_update`	Org/Project	`mks_update`	Enable or disable the cluster's monitoring
`mks_metadata_update`	Org/Project	`mks_update`	Rename a cluster or edit its description

Virtual machines¶

The import, ownership and control permissions apply to virtual machines imported from your cloud account. Detach works on any virtual machine, created or imported. See Imported Resources.

Permission	Scope	Implied by	Description
`mvms_create`	Org/Project	—	Create a virtual machine
`mvms_get`	Org/Project	—	Full read access to a VM. Implies the metadata, logs, console, cloud-init and metrics reads below
`mvms_list`	Org/Project	—	List virtual machines
`mvms_update`	Org/Project	—	Update a VM. Implies every fine-grained VM operation below
`mvms_delete`	Org/Project	—	Delete a virtual machine, destroying it in your cloud account
`mvms_import`	Org/Project	—	Import an existing server from your cloud account. Importing it as Managed also needs `mvms_control_update`
`mvms_detach`	Org/Project	—	Detach a VM: the platform stops managing it, but the server keeps running in your cloud account
`mvms_authority_update`	Org/Project	—	Take ownership of an imported VM. Needed before an imported VM can be deleted
`mvms_control_update`	Org/Project	—	Switch an imported VM between Read-only and Managed, or import it as Managed
`mvms_power_update`	Org/Project	`mvms_update`	Start or stop a VM
`mvms_resize_update`	Org/Project	`mvms_update`	Resize a VM
`mvms_network_attachment_update`	Org/Project	`mvms_update`	Change a VM's networks
`mvms_action_update`	Org/Project	`mvms_update`	Run cancel or sync actions on VM operations
`mvms_monitoring_update`	Org/Project	`mvms_update`	Enable or disable the VM's monitoring
`mvms_metadata_update`	Org/Project	`mvms_update`	Rename a VM or edit its description
`mvms_metadata_get`	Org/Project	`mvms_get`	View a VM, its network attachments and its action history, without the console, logs, cloud-init or metrics
`mvms_logs_get`	Org/Project	`mvms_get`	Read the VM's console logs
`mvms_console_get`	Org/Project	`mvms_get`	Open the VM's interactive console
`mvms_cloudinit_get`	Org/Project	`mvms_get`	Read the cloud-init user data the VM was created with (Show cloud-init), which often contains credentials
`mvms_metrics_get`	Org/Project	`mvms_get`	Read VM metrics

VM backups¶

Backup permissions are independent of the VM permissions above. While the VM exists, its backups are created, listed and deleted on its Snapshots tab. A backup is also an image in the infrastructure's image catalog, where it can be deleted too, and it stays there after the VM is deleted. Seeing it in the catalog or in the Image picker needs infrastructure and image read permissions (see Images), not mvms_snapshot_list.

Permission	Scope	Implied by	Description
`mvms_snapshot_create`	Org/Project	—	Create a backup of a VM
`mvms_snapshot_list`	Org/Project	—	List a VM's backups
`mvms_snapshot_update`	Org/Project	—	Edit a backup's name, description, enabled flag or project access
`mvms_snapshot_delete`	Org/Project	—	Delete a backup

PostgreSQL instances¶

Permission	Scope	Implied by	Description
`postgresql_instance_create`	Org/Project	—	Create a PostgreSQL instance
`postgresql_instance_get`	Org/Project	—	Full read access to an instance. Implies the metadata, connection and metrics reads below
`postgresql_instance_list`	Org/Project	—	List PostgreSQL instances
`postgresql_instance_update`	Org/Project	—	Update an instance. Implies every fine-grained instance operation below
`postgresql_instance_delete`	Org/Project	—	Delete a PostgreSQL instance
`postgresql_instance_metadata_get`	Org/Project	`postgresql_instance_get`	View an instance and its action history, and read the tiers, sizes and versions available in a project (needed by the create and resize forms), without the connection information
`postgresql_instance_connection_get`	Org/Project	`postgresql_instance_get`	Read the instance connection information, including database credentials
`postgresql_instance_metrics_get`	Org/Project	`postgresql_instance_get`	Read instance metrics
`postgresql_instance_action_update`	Org/Project	`postgresql_instance_update`	Run cancel or sync actions on instance operations
`postgresql_instance_resize_update`	Org/Project	`postgresql_instance_update`	Resize an instance: its tier (or size, on platforms without tiers), storage (grow-only) and high availability
`postgresql_instance_upgrade_update`	Org/Project	`postgresql_instance_update`	Upgrade the instance's PostgreSQL version
`postgresql_instance_monitoring_update`	Org/Project	`postgresql_instance_update`	Enable or disable the instance's monitoring
`postgresql_instance_metadata_update`	Org/Project	`postgresql_instance_update`	Rename an instance or edit its description

Networking permissions¶

These permissions cover the networks, routers, firewalls and SSH keys under COMPUTE & NETWORK.

Each resource type also has standalone permissions for resources imported from your cloud account. You import with _import. You take ownership before deleting an imported resource with _authority_update. You switch between Read-only and Managed with _control_update. Imported SSH keys are always read-only, so SSH keys have no control permission. Removing any of these resources is either a delete (_delete), which destroys it in your cloud account, or a detach (_detach), which leaves it running there. See Imported Resources.

Sharing never grants permissions. The _share permission is checked on the owner project; see Sharing Resources for what each side needs.

Networks¶

Permission	Scope	Implied by	Description
`network_create`	Org/Project	—	Create a network
`network_get`	Org/Project	—	Full read access to a network. Implies `network_metadata_get`
`network_list`	Org/Project	—	List networks, including networks shared with the project. Also needed to pick an external network when creating a router
`network_update`	Org/Project	—	Update a network. Implies every fine-grained network operation below
`network_delete`	Org/Project	—	Delete a network, destroying it in your cloud account
`network_import`	Org/Project	—	Import an existing network from your cloud account. Importing it as Managed also needs `network_control_update`
`network_detach`	Org/Project	—	Detach a network: the platform stops managing it, but it stays in your cloud account
`network_authority_update`	Org/Project	—	Take ownership of an imported network. Needed before an imported network can be deleted
`network_control_update`	Org/Project	—	Switch an imported network between Read-only and Managed, or import it as Managed
`network_share`	Org/Project	—	Choose which projects a network is shared with
`network_metadata_get`	Org/Project	`network_get`	View a network, its used IP addresses, dependents, sharing and action history
`network_action_update`	Org/Project	`network_update`	Run cancel or sync actions on network operations
`network_dhcp_update`	Org/Project	`network_update`	Edit the network's DHCP configuration (allocation pools, DNS servers, gateway, static routes)
`network_metadata_update`	Org/Project	`network_update`	Rename a network or edit its description

Routers¶

Permission	Scope	Implied by	Description
`router_create`	Org/Project	—	Create a router
`router_get`	Org/Project	—	Full read access to a router. Implies `router_metadata_get`
`router_list`	Org/Project	—	List routers
`router_update`	Org/Project	—	Update a router. Implies every fine-grained router operation below
`router_delete`	Org/Project	—	Delete a router, destroying it in your cloud account
`router_import`	Org/Project	—	Import an existing router from your cloud account. Importing it as Managed also needs `router_control_update`
`router_detach`	Org/Project	—	Detach a router: the platform stops managing it, but it stays in your cloud account
`router_authority_update`	Org/Project	—	Take ownership of an imported router. Needed before an imported router can be deleted
`router_control_update`	Org/Project	—	Switch an imported router between Read-only and Managed, or import it as Managed
`router_metadata_get`	Org/Project	`router_get`	View a router, its static routes, network attachments and action history
`router_routes_update`	Org/Project	`router_update`	Add and remove static routes on a router
`router_network_attachment_update`	Org/Project	`router_update`	Attach and detach networks on a router
`router_action_update`	Org/Project	`router_update`	Run cancel or sync actions on router operations
`router_metadata_update`	Org/Project	`router_update`	Rename a router or edit its description

Firewalls¶

Permission	Scope	Implied by	Description
`firewall_create`	Org/Project	—	Create a firewall
`firewall_get`	Org/Project	—	Full read access to a firewall. Implies `firewall_metadata_get`
`firewall_list`	Org/Project	—	List firewalls, including firewalls shared with the project
`firewall_update`	Org/Project	—	Update a firewall. Implies every fine-grained firewall operation below
`firewall_delete`	Org/Project	—	Delete a firewall, destroying it in your cloud account
`firewall_import`	Org/Project	—	Import an existing firewall from your cloud account. Importing it as Managed also needs `firewall_control_update`
`firewall_detach`	Org/Project	—	Detach a firewall: the platform stops managing it, but it stays in your cloud account
`firewall_authority_update`	Org/Project	—	Take ownership of an imported firewall. Needed before an imported firewall can be deleted
`firewall_control_update`	Org/Project	—	Switch an imported firewall between Read-only and Managed, or import it as Managed
`firewall_share`	Org/Project	—	Choose which projects a firewall is shared with
`firewall_metadata_get`	Org/Project	`firewall_get`	View a firewall, its dependents, sharing and action history
`firewall_action_update`	Org/Project	`firewall_update`	Run cancel or sync actions on firewall operations
`firewall_rules_update`	Org/Project	`firewall_update`	Edit the firewall's ruleset
`firewall_metadata_update`	Org/Project	`firewall_update`	Rename a firewall or edit its description

SSH keys¶

Permission	Scope	Implied by	Description
`sshkey_create`	Org/Project	—	Create an SSH key: upload a public key or have a key pair generated
`sshkey_get`	Org/Project	—	Full read access to an SSH key. Implies `sshkey_metadata_get`
`sshkey_list`	Org/Project	—	List SSH keys, including keys shared with the project
`sshkey_delete`	Org/Project	—	Delete an SSH key, removing it from your cloud account
`sshkey_import`	Org/Project	—	Import an existing SSH key from your cloud account. Imported keys are always read-only
`sshkey_detach`	Org/Project	—	Detach an SSH key: the platform stops tracking it, but it stays in your cloud account
`sshkey_authority_update`	Org/Project	—	Take ownership of an imported SSH key. Needed before an imported key can be deleted
`sshkey_share`	Org/Project	—	Choose which projects an SSH key is shared with
`sshkey_attach`	Org/Project	—	Add an SSH key to a VM when creating it. Checked in the VM's project
`sshkey_metadata_get`	Org/Project	`sshkey_get`	View an SSH key, its dependents, sharing and action history

Application orchestration permissions¶

These permissions cover the APPLICATIONS pages; their names start with meo_application.

Marketplace templates¶

Permission	Scope	Implied by	Description
`meo_application_template_get`	Org/Project	—	View an application template and its versions, and a marketplace category
`meo_application_template_list`	Org/Project	—	List application templates and marketplace categories
`meo_application_template_create`	Org/Project	—	Create an application template
`meo_application_template_patch`	Org/Project	—	Update an application template
`meo_application_template_delete`	Org/Project	—	Delete an application template

Application instances¶

Permission	Scope	Implied by	Description
`meo_application_instance_get`	Org/Project	—	View an application instance and its action history
`meo_application_instance_list`	Org/Project	—	List application instances
`meo_application_instance_create`	Org/Project	—	Deploy an application (create an instance)
`meo_application_instance_update`	Org/Project	—	Update an application instance and run actions on it
`meo_application_instance_delete`	Org/Project	—	Delete an application instance

Clusters¶

Permission	Scope	Implied by	Description
`meo_application_cluster_get`	Org/Project	—	View a cluster and its action history
`meo_application_cluster_list`	Org/Project	—	List clusters
`meo_application_cluster_create`	Org/Project	—	Register a cluster
`meo_application_cluster_patch`	Org/Project	—	Update a cluster
`meo_application_cluster_delete`	Org/Project	—	Delete a cluster
`meo_application_cluster_getfleet`	Org/Project	—	View the fleet a cluster belongs to

Fleets¶

Permission	Scope	Implied by	Description
`meo_application_clusterfleet_get`	Org/Project	—	View a fleet
`meo_application_clusterfleet_list`	Org/Project	—	List fleets
`meo_application_clusterfleet_create`	Org/Project	—	Create a fleet
`meo_application_clusterfleet_patch`	Org/Project	—	Update a fleet, including replacing its list of clusters
`meo_application_clusterfleet_delete`	Org/Project	—	Delete a fleet
`meo_application_clusterfleet_addcluster`	Org/Project	—	Add a cluster to a fleet
`meo_application_clusterfleet_removecluster`	Org/Project	—	Remove a cluster from a fleet

Fleet instances¶

Permission	Scope	Implied by	Description
`meo_application_clusterfleetinstance_get`	Org/Project	—	View a fleet instance and its action history
`meo_application_clusterfleetinstance_list`	Org/Project	—	List fleet instances
`meo_application_clusterfleetinstance_create`	Org/Project	—	Create a fleet instance
`meo_application_clusterfleetinstance_patch`	Org/Project	—	Update a fleet instance and run actions on it
`meo_application_clusterfleetinstance_delete`	Org/Project	—	Delete a fleet instance

Dashboard permissions¶

These read-only organization permissions back the counts on the Dashboard. They expose totals, not the resources themselves.

Permission	Scope	Implied by	Description
`resourcemanager_organization_stats_get`	Org	—	Read project, member and group counts
`meo_organization_stats_get`	Org	—	Read application counts
`rex_stats_get`	Org	—	Read infrastructure and managed resource counts

Organization administrator (OrganizationAdmin)¶

Every organization has OrganizationAdmin, a role defined by the platform. It carries the special all_permissions grant, so its holders can do everything on this page, in the organization and in all its projects. It can only be assigned on the organization, can't be edited or deleted, and all_permissions can't be granted any other way. Who can assign it, and the owner's guarantee, are described in Owner and administrators.

Permissions with no effect¶

Permissions you can grant but that change nothing

These permissions are in the catalog, but nothing in the console checks them. Granting them has no effect.

resourcemanager_organization_patch, resourcemanager_project_patch, resourcemanager_group_patch: renaming uses the matching _update permission.
resourcemanager_organization_delete, resourcemanager_project_delete: organizations and projects can't be deleted.
resourcemanager_group_user_list
resourcemanager_organization_quota_profile_register, resourcemanager_organization_quota_profile_update, resourcemanager_organization_quota_profile_deregister: only your platform operator can change quota profiles.
mvms_snapshot_get
sshkey_update: SSH keys can't be edited.
meo_application_template_update, meo_application_cluster_update, meo_application_clusterfleet_update: editing uses the matching _patch permission.
meo_application_instance_patch: updating uses meo_application_instance_update.

If a permission is refused, see When an action is refused. For how to choose what to grant, see Best practices.