Manage cloud platform network access

Last update: October 13 2026Open in Markdown

Cloud platform network access is governed by:

• projects — define access within an isolated group of resources;
• role-based model — defines access of different users within an account and project.

Access within the role model

For more information about access within the role-based model, see the Access management in Selectel products instructions.

This instruction describes roles for accessing Cloud Platform network resources: private networks, subnets, and ports, public subnets and ports, direct public IP addresses, public floating IP addresses, and cloud routers. Access to load balancers, access to cloud firewalls, and access to security groups are managed separately.

member

A user with full access to all services. Access management is unavailable: users, service users, user groups, and federations.

Access scopes	Account Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects; managing private networks, subnets, and ports in all projects: creating and deleting a network and subnet; changing the name and tags of a network and subnet; configuring network access in different projects; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; connecting a network to a global router and disconnecting it; creating a port in a network and deleting a port; enabling and disabling a port in a network; managing allowed addresses and security groups on a port in a network; managing public subnets in all projects: creating and deleting a subnet; changing the name and tags of a subnet; changing DNS servers; configuring access to a subnet in different projects; creating and deleting a port in a subnet; managing direct public IP addresses in all projects: creating an IP address with an associated port; deleting an IP address with an associated port; enabling and disabling a port with an IP address; managing public floating IP addresses in all projects: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in all projects: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project; managing private networks, subnets, and ports in your project: creating and deleting a network and subnet; changing network and subnet names and tags; configuring network access in different projects (access to each project is required); changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; creating a port in a network and deleting a port; enabling and disabling a port in a network; managing allowed addresses and security groups on a port; managing public subnets in your project: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; configuring access to a subnet in different projects; creating and deleting a port in a subnet; enabling and disabling a port in a network; managing direct public IP addresses in your project: creating an IP address with an associated port; deleting an IP address with an associated port; changing a port with an IP address; detaching a port; managing public floating IP addresses in your project: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in your project: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them

iam.admin

A user with access to user management and without access to services and billing. Cannot manage their own account: change permissions, manage notifications, delete the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	Managing panel users, service users, user groups with access to Cloud Platform networks, as well as managing federations

iam.viewer

A user with access to view everything that iam.admin manages.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	Viewing panel users, service users, user groups, and federations; viewing user keys; viewing notifications of other users; viewing account access restrictions

reader

A user with access to view everything that member manages within the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project

vpc.admin

User with access to managing cloud platform networks (private networks and subnets, public subnets and public floating IP addresses, cloud routers), cloud firewalls, security groups, and cloud load balancers.

Adding ports to a cloud server and deleting ports added to a cloud server are not available; this requires the member role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects; managing private networks, subnets, and ports in all projects: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; connecting a subnet to a global router and disconnecting from it (additionally requires the global_router.admin role); creating a port in a network (without adding it to a cloud server) and deleting a port in a network (except for those added to a cloud server); enabling and disabling a port in a network; managing public subnets in all projects: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network; managing direct public IP addresses in all projects: creating an IP address with a bound port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with a bound port (except those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing public floating IP addresses in all projects: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in all projects: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project; managing private networks, subnets, and ports in your project: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting it; connecting a subnet to a global router and disconnecting from it (additionally requires the global_router.admin role); creating a port in a network (without adding it to a cloud server) and deleting a port in a network (except for those added to a cloud server); enabling and disabling a port in a network; managing public subnets in your project: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network; managing public floating IP addresses in your project: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing direct public IP addresses in your project: creating an IP address with a bound port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with a bound port (except those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing cloud routers in your project: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting private subnets to the router and disconnecting them

vpc.viewer

A user with access to view everything that vpc.admin manages within the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of all cloud platform network resources and information about them in all projects
	In the Project access scope: viewing the list of all cloud platform network resources and information about them in your project

vpc.private_network.admin

User with access to managing private networks, subnets, and ports.

Adding ports to a cloud server and deleting ports added to a cloud server are not available; this requires the member role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of private networks, subnets, ports, and information about them in all projects; managing private networks, subnets, and ports in all projects: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting from it (additionally requires the vpc.external_access.admin role); connecting a subnet to a global router and disconnecting from it (additionally requires the global_router.admin role); creating a port in a network (without assigning to a cloud server) and deleting a port in a network (except for those assigned to a cloud server); enabling and disabling a port in a network
	In the Project access scope: viewing the list of private networks, subnets, ports, and information about them in your project; managing private networks, subnets, and ports in your project: creating and deleting a network and subnet; changing network and subnet names and tags; changing automatic subnet network settings (gateway, DNS servers, static routes, DHCP state); connecting a subnet to a cloud router and disconnecting from it (additionally requires the vpc.external_access.admin role); connecting a subnet to a global router and disconnecting from it (additionally requires the global_router.admin role); creating a port in a network (without assigning to a cloud server) and deleting a port in a network (except for those assigned to a cloud server); enabling and disabling a port in a network

vpc.private_network.viewer

A user with access to view everything that vpc.private_network.admin manages within the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of private networks, subnets, ports, and information about them in all projects
	In the Project access scope: viewing the list of private networks, subnets, ports, and information about them in your project

vpc.external_access.admin

User with access to managing objects for internet access — public subnets, public floating IP addresses, cloud routers.

Adding ports to a cloud server and deleting ports added to a cloud server are not available; this requires the compute.admin role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects; managing public subnets in all projects: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network managing direct public IP addresses in all projects: creating an IP address with a bound port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with a bound port (except those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing public floating IP addresses in all projects: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in all projects: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting a private subnet to a router and disconnecting from it (additionally requires the vpc.private_network.admin role)
	In the Project access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project; managing public subnets in your project: creating and deleting a subnet; changing subnet name and tags; changing DNS servers; creating and deleting a port in a subnet; enabling and disabling a port in a network managing direct public IP addresses in your project: creating an IP address with a bound port (without adding to a cloud server; this additionally requires the compute.admin or compute.server.user role); deleting an IP address with a bound port (except those added to a cloud server; this additionally requires the compute.admin or compute.server.user role); enabling and disabling a port with an IP address; managing public floating IP addresses in your project: creating and deleting an IP address; attaching an IP address to a port in a private network; switching between ports; detaching from a port; managing cloud routers in your project: creating and deleting a router; changing a router name and tags; enabling and disabling a router; connecting the router to the internet and disconnecting it; managing static routes on the router; connecting a private subnet to a router and disconnecting from it (additionally requires the vpc.private_network.admin role)

vpc.external_access.user

A user with access to view everything that vpc.external_access.admin manages within the same access scope, as well as access to manage public floating IP addresses.

Adding ports to a cloud server and deleting ports added to a cloud server are not available; this requires the compute.admin role.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects; managing public floating IP addresses in all projects: attaching an IP address to a port in a private network, switching between ports, detaching from a port
	In the Project access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project; managing public floating IP addresses in your project: attaching an IP address to a port in a private network, switching between ports, detaching from a port

vpc.external_access.viewer

A user with access to view everything that vpc.external_access.admin manages within the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available cloud platform network operations	In the Account access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in all projects
	In the Project access scope: viewing the list of public subnets, direct public IP addresses and public floating IP addresses, ports in public networks, cloud routers, and information about them in your project