---
title: "Manage access to Cloud for 1C"
sidebar_label: "Manage access to Cloud for 1C"
sidebar_position: 3
description: "How access to Cloud for 1C is regulated by projects and roles; available API keys"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import {CustomTable} from '@selectel/docux/components'

# Manage access to Cloud for 1C

Access to Cloud for 1C is regulated by:

* [projects](/access-control/projects/about-projects.mdx) — define access within an isolated group of resources;
* [roles](#access-within-roles) — define access for [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users) and [groups](/access-control/groups/) within an account and project.

For access via [API](/api/) use [keys](#keys-for-api-access).

Read more about access management in the [Access management in Selectel products](/access-control/access-management.mdx) guide.

## Access within roles \{#access-within-roles}

Access to Cloud for 1C is granted by [Cloud for 1C roles](#go1c-roles) and [global roles](#global-roles). Read more in the [Role reference](/access-control/role-reference.mdx) guide.

<CustomTable>
  <table>
    <thead>
      <tr>
        <th>Role group</th><th>Role</th><th>Access</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th rowspan="2">Cloud for 1C roles</th><th>[go1c.admin](#go1c-admin)</th><td>Manage Cloud for 1C resources</td>
      </tr>

      <tr>
        <th>[go1c.viewer](#go1c-viewer)</th><td>View Cloud for 1C resources</td>
      </tr>

      <tr>
        <th rowspan="5">Global roles</th><th>[member](#member)</th><td>Manage Cloud for 1C resources and other products, account, billing, and projects</td>
      </tr>

      <tr>
        <th>[billing](#billing)</th><td>Manage billing for Cloud for 1C and other products</td>
      </tr>

      <tr>
        <th>[iam.admin](#iam-admin)</th><td>Manage access to Cloud for 1C and other products</td>
      </tr>

      <tr>
        <th>[iam.viewer](#iam-viewer)</th><td>View access to Cloud for 1C and other products</td>
      </tr>

      <tr>
        <th>[reader](#reader)</th><td>View Cloud for 1C and other product resources, account, billing, and projects</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Cloud for 1C roles \{#go1c-roles}

#### go1c.admin \{#go1c-admin}

The `go1c.admin` role provides access to manage Cloud for 1C resources. Does not provide access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations in Cloud for 1C</th>

        <td>
          In the Account access scope:

          * manage 1C server clusters in all projects:

            * create a server cluster;
            * scale a cluster;
            * change cluster settings (enable automatic disk scaling, web server, web publication, and debug mode; manage IP address allowlist for accessing web publications; add custom domains);
            * manage storage (connect and disconnect S3 buckets) `*`;
            * connect to a private network `**;`;
            * rent 1C licenses;
            * change maintenance window;
            * terminate user sessions;
            * restart a cluster;
            * delete a cluster;
          * manage info-bases in all projects:

            * create an info-base;
            * upload an info-base from a `.dt` file `*`;
            * manage scheduled job execution;
            * configure user sessions (block, allow, terminate);
            * create a backup;
            * change web publication configuration;
            * delete an info-base;
          * manage databases in all projects:

            * create databases;
            * scale a database;
            * manage automatic disk scaling;
            * change maintenance window;
            * delete a database;
          * manage backups in all projects:

            * create a backup storage `*`;
            * edit storage `*`;
          * manage Prometheus tokens for collecting metrics in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * manage 1C server clusters in your project:

            * create a server cluster;
            * scale a cluster;
            * change cluster settings (enable automatic disk scaling, web server, web publication, and debug mode; manage IP address allowlist for accessing web publications; add custom domains);
            * manage storage (connect and disconnect S3 buckets) `*`;
            * connect to a private network `**;`;
            * rent 1C licenses;
            * change maintenance window;
            * terminate user sessions;
            * restart a cluster;
            * delete a cluster;
          * manage info-bases in your project:

            * create an info-base;
            * manage scheduled job execution;
            * configure user sessions (block, allow, terminate);
            * create a backup;
            * change web publication configuration;
            * delete an info-base;
          * manage databases in your project:

            * create databases;
            * scale a database;
            * manage automatic disk scaling;
            * change maintenance window;
            * delete a database;
          * manage backups in your project:

            * create a backup storage `*`;
            * edit storage `*`;
          * manage Prometheus tokens for collecting metrics in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

`*` To manage connecting backup storage, cluster data storage, and uploading an info-base from a `.dt` file, you additionally need a combination of the [`s3.admin`](/access-control/role-reference.mdx#s3-admin) and [`iam.admin`](/access-control/role-reference.mdx#iam-admin) roles.

` **` To manage connecting a cluster to a private network that has already been created in a project, you additionally need the [vpc.private\_network.viewer](/access-control/role-reference.mdx#vpc-private-network-viewer) role.

#### go1c.viewer \{#go1c-viewer}

The `go1c.viewer` role provides access to view everything that [go1c.admin](#go1c-admin) manages.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations in Cloud for 1C</th>

        <td>
          In the Account access scope:

          * view 1C server clusters in all projects;
          * view info-bases in all projects;
          * view databases in all projects;
          * view backups in all projects;
          * view a list of generated Prometheus tokens for collecting metrics in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view 1C server clusters in your project;
          * view info-bases in your project;
          * view databases in your project;
          * view backups in your project;
          * view a list of generated Prometheus tokens for collecting metrics in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### Global roles \{#global-roles}

#### member \{#member}

The `member` role provides full access to all services. Does not provide access to manage [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations in Cloud for 1C</th>

        <td>
          In the Account access scope:

          * manage 1C server clusters in all projects:

            * create a server cluster;
            * scale a cluster;
            * change cluster settings (enable automatic disk scaling, web server, web publication, and debug mode; manage IP address allowlist for accessing web publications; add custom domains);
            * manage storage (connect and disconnect S3 buckets) `*`;
            * connect to a private network;
            * rent 1C licenses;
            * change maintenance window;
            * terminate user sessions;
            * restart a cluster;
            * delete a cluster;
          * manage info-bases in all projects:

            * create an info-base;
            * upload an info-base from a `.dt` file `*`;
            * manage scheduled job execution;
            * configure user sessions (block, allow, terminate);
            * create a backup;
            * change web publication configuration;
            * delete an info-base;
          * manage databases in all projects:

            * create databases;
            * scale a database;
            * manage automatic disk scaling;
            * change maintenance window;
            * delete a database;
          * manage backups in all projects:

            * create a backup storage `*`;
            * edit storage `*`;
          * manage Prometheus tokens for collecting metrics in all projects;
          * manage projects, their limits, and quotas;
          * manage billing in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * manage 1C server clusters in your project:

            * create a server cluster;
            * scale a cluster;
            * change cluster settings (enable automatic disk scaling, web server, web publication, and debug mode; manage IP address allowlist for accessing web publications; add custom domains);
            * manage storage (connect and disconnect S3 buckets) `*`;
            * rent 1C licenses;
            * change maintenance window;
            * terminate user sessions;
            * restart a cluster;
            * delete a cluster;
          * manage info-bases in your project:

            * create an info-base;
            * manage scheduled job execution;
            * configure user sessions (block, allow, terminate);
            * create a backup;
            * change web publication configuration;
            * delete an info-base;
          * manage databases in your project:

            * create databases;
            * scale a database;
            * manage automatic disk scaling;
            * change maintenance window;
            * delete a database;
          * manage backups in your project:

            * create a backup storage `*`;
            * edit storage `*`;
          * manage Prometheus tokens for collecting metrics in your project;
          * manage limits and quotas in your project;
          * manage billing in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

`*` To manage connecting backup storage, cluster data storage, and uploading an info-base from a `.dt` file, you additionally need the [`iam.admin`](/access-control/role-reference.mdx#iam-admin) role.

#### billing \{#billing}

The `billing` role provides access to manage billing without access to manage services.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations in Cloud for 1C</th>

        <td>
          * manage billing;
          * view rented 1C licenses;
          * view Cloud for 1C consumption
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

#### iam.admin \{#iam-admin}

The `iam.admin` role provides access to manage users. Does not provide access to services and billing, or to manage your own account: changing permissions, managing notifications, deleting a user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations in Cloud for 1C</th><td>Manage [users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), and [user groups](/access-control/groups/)</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

#### iam.viewer \{#iam-viewer}

The `iam.viewer` role provides access to view everything that [iam.admin](#iam-admin) manages.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations in Cloud for 1C</th><td>View [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), and [user groups](/access-control/groups/)</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

#### reader \{#reader}

The `reader` role provides access to view everything that [`member`](#member) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations in Cloud for 1C</th>

        <td>
          In the Account access scope:

          * view 1C server clusters in all projects;
          * view info-bases in all projects;
          * view databases in all projects;
          * view backups in all projects;
          * view a list of generated Prometheus tokens for collecting metrics in all projects;
          * view projects, their limits, and quotas;
          * view billing data and consumption
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view 1C server clusters in your project;
          * view info-bases in your project;
          * view databases in your project;
          * view backups in your project;
          * view a list of generated Prometheus tokens for collecting metrics in your project;
          * view limits and quotas in your project;
          * view billing data and consumption in your project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Keys for API access \{#keys-for-api-access}

Depending on the API type, you will need:

* An IAM token for the project for access via [Cloud for 1C API](/api/1c-cloud/). Tokens can be issued to [service users](/access-control/user-types.mdx#service-users). To issue an IAM token for a project, use the [Get an IAM token for a project](/api/authorization/#get-iam-token-project-scoped) section of the [Request authentication](/api/authorization/) guide in the API documentation;
* A Prometheus token for collecting Cloud for 1C metrics. To create a Prometheus token, use the [Get token](/cloud-1c/cluster/monitoring.mdx#get-token) section of the [Monitoring a 1C server cluster](/cloud-1c/cluster/monitoring.mdx) guide.

<Formbricks />