---
title: "Manage network volume access"
sidebar_label: "Manage network volume access"
sidebar_position: 3
description: "How network volume access is governed by a role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage network volume access

Access to network volumes is governed by a role-based access control model that defines access within an account; for more details, see the [Access Management in Selectel Products](/access-control/access-management.mdx) guide. You can view the capabilities of roles across all products in the [role reference](/access-control/role-reference.mdx).

## member \{#member}

A user with full access to all Selectel products. Does not have management access to: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available network volume operations</th>

        <td>
          In the Account access scope:

          * network volume management:

            * creating a network volume;
            * modifying network volumes (changing volume size, connecting a volume to a server, etc.);
            * deleting a network volume
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope, network volume operations are unavailable
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## billing \{#billing}

User with access to billing management and without access to service management.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available network volume operations</th>

        <td>
          * billing management:

            * balance top-ups and transferring funds between balances;
            * management of autobills, monthly payments, payment deferrals;
            * management of balance notifications;
            * bank card management;
            * viewing reporting documents;
            * management of the affiliate program and funds withdrawal;

          * viewing connected services and service statuses
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.admin \{#iam-admin}

A user with access to user management who does not have access to services or billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available network volume operations</th>

        <td>
          * managing [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to network volumes, as well as managing [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.viewer \{#iam-viewer}

User with access to view everything managed by [iam.admin](#iam-admin).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          <ul>
            <li>users;</li><li>service users;</li><li>user groups</li>
          </ul>
        </td>
      </tr>

      <tr>
        <th>Available operations</th>

        <td>
          <ul>
            <li>viewing [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) and [federations](/access-control/federations/);</li><li>viewing user keys;</li><li>viewing [notifications](/account/notifications.mdx) of other users;</li><li>viewing [account access restrictions](/account/limit-access-to-account.mdx)</li>
          </ul>
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## reader \{#reader}

User with access to view everything managed by [`member`](#member) in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available network volume operations</th>

        <td>
          In the Account access scope:

          * viewing the list of network volumes and information about them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope, network volume operations are unavailable
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## dedicated.admin \{#dedicated-admin}

User with access to network volume management for dedicated servers.

The `dedicated.admin` role also grants access to manage:

* [dedicated servers](/dedicated/);
* [colocation](/server-colocation/);
* [firewalls](/firewalls/);
* [basic firewall](/basic-firewall/);
* [data storage system](/data-storage-system/);
* [leased network hardware](/network-hardware/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available network volume operations</th>

        <td>
          In the Account access scope:

          * network volume management:

            * creating a network volume;
            * modifying network volumes (changing volume size, connecting a volume to a server, etc.);
            * deleting a network volume
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope, network volume operations are unavailable
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## dedicated.viewer \{#dedicated-viewer}

User with access to view everything managed by [`dedicated.admin`](#dedicated-admin) in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available network volume operations</th>

        <td>
          In the Account access scope:

          * viewing the list of network volumes and information about them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope, network volume operations are unavailable
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />