---
title: "Access management in Selectel products"
sidebar_label: "Access management"
sidebar_position: 1
description: "How access management is structured in Selectel products, what permissions, scopes, and roles are, and what constraints exist in certain products"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import {CustomTable} from 'docs-kit/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from 'docs-kit/components'

# Access management in Selectel products

To manage access to Selectel products, [projects](/access-control/projects/about-projects.mdx) and users are used.

When [registering an account](/account/registration.mdx), a primary user is created automatically — [Account Owner](/access-control/user-types.mdx#account-owner), who has access to managing all account resources. The Account Owner can [create additional users](/access-control/manage/add-user.mdx). Users can be of different [types](/access-control/user-types.mdx), and they can be granted different [permissions](#permissions) — assign roles within a specific scope.

In addition to the Account Owner, other users with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role can manage other users. You can find more information about the capabilities of each role in the [Role Reference](/access-control/role-reference.mdx).

Users can be added to [groups](/access-control/groups/) to manage multiple users as one.

You can manage users and roles in the [control panel](https://my.selectel.ru/iam/users), using [IAM API](/api/users-and-roles/) or [Terraform](/terraform/providers/).

Records of access management operations are saved in [audit logs](/audit-logs/about-audit-logs.mdx).

Access management in certain Selectel products is [restricted](#restrictions).

## Permissions \{#permissions}

A permission (Permission) determines which operations a user can perform and on which group of resources.

A permission consists of an [access scope](#scopes) and a [role](#roles).

A permission can be assigned to different subjects: a [user](/access-control/user-types.mdx#users), a [service user](/access-control/user-types.mdx#service-users), or a [group](/access-control/groups/). You can assign multiple permissions at once and change them.

### Access scopes \{#scopes}

A permission scope is a group of resources to which the permission is granted. The permission scope can be:

* account (`account`) — all account resources, including the resources of all projects;
* projects (`project`) — resources of selected projects.

### Roles⁠​ \{#roles}

A role is a set of predefined rights that determine which actions a user can perform on resources of a certain type or on account settings.

A role determines access within the [scope](#scopes), which is specified in the [permission](#permissions). The scopes available to a specific role depend on the [user type](/access-control/user-types.mdx). For more information about the capabilities of each role, see the [Role Reference](/access-control/role-reference.mdx).

#### Role model update \{#roles-update}

Before the role model update in September 2025, user access was determined only by their roles. After the update, the old concept of a role corresponds to a [permission](#permissions) — a combination of a role and a scope. Roles have been renamed. The capabilities of the roles have not changed.

<CustomTable>
  <table data-sticky>
    <thead>
      <tr>
        <th>Old role name</th><th>Role</th><th>Access scope</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>Account administrator</th><th rowspan="2">member</th><th>Account</th>
      </tr>

      <tr>
        <th>Project administrator</th><th>Project</th>
      </tr>

      <tr>
        <th>Billing administrator</th><th>billing</th><th>Account</th>
      </tr>

      <tr>
        <th>User administrator</th><th>iam.admin</th><th>Account</th>
      </tr>

      <tr>
        <th>Account viewer</th><th rowspan="2">reader</th><th>Account</th>
      </tr>

      <tr>
        <th>Project viewer</th><th>Project</th>
      </tr>

      <tr>
        <th>S3 administrator</th><th>object\_storage\_admin</th><th>Project</th>
      </tr>

      <tr>
        <th>S3 user</th><th>object\_storage\_user</th><th>Project</th>
      </tr>

      <tr>
        <th>Mobile farm administrator</th><th>mobile\_farm.admin</th><th>Project</th>
      </tr>

      <tr>
        <th>Mobile farm user</th><th>mobile\_farm.user</th><th>Project</th>
      </tr>

      <tr>
        <th>Mobile farm viewer</th><th>mobile\_farm.viewer</th><th>Project</th>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Access management constraints in certain products \{#restrictions}

Some products and services do not support the division of resources into [projects](/access-control/projects/about-projects.mdx) and may additionally have their own access system:

* VMware-based cloud products: Public cloud powered by VMware, disaster recovery to the cloud powered by VMware, virtual desktop rental;
* Selectel email service;
* Direct Connect;
* Global Connect;
* IP address accounting;
* DDoS protection;
* Fault tolerant load balancer;
* AI Marketplace, ML platform;
* backup and recovery products: Agent-based backup (Veeam Agent), Veeam Cloud Connect cloud repository, Cyber Backup Cloud;
* Uptime check (formerly Monitoring);
* Logs.

In S3, user access to a bucket can be modified in accordance with an access policy; for more information, see the [Managing access in S3](/s3/manage/manage-access.mdx).

<Formbricks />