---
title: "Manage access to cloud load balancers"
sidebar_label: "Manage access to load balancers"
sidebar_position: 2
description: "How access to cloud load balancers is governed by projects and a role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage access to cloud load balancers

Access to cloud load balancers is governed by:

* [projects](/access-control/projects/about-projects.mdx) — define access within an isolated group of resources;
* [a role model](#access-within-roles) — defines access for [different users](/access-control/user-types.mdx) within an account and [project](/access-control/projects/about-projects.mdx).

## Access within the role model \{#access-within-roles}

Learn more about role-based access in the [Access management in Selectel products](/access-control/access-management/) guide.

### member \{#member}

A user with full access to all services. Access management is not available for: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud load balancers</th>

        <td>
          In the Account access scope:

          * view the list of all balancer objects and their information across all projects: load balancers, rules and HTTP policies, target groups and servers within them, and health checks;
          * viewing load balancer statistics across all projects;
          * managing load balancers, rules and HTTP policies, target groups, and health checks across all projects;
          * enabling and disabling load balancer logging across all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view the list of all balancer objects and their information in the selected project: load balancers, rules and HTTP policies, target groups and servers within them, and health checks;
          * viewing load balancer statistics in the selected project;
          * managing load balancers, rules and HTTP policies, target groups, and health checks in the selected project;
          * enabling and disabling load balancer logging in the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.admin \{#iam-admin}

A user with access to user management and no access to services or billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with cloud load balancers</th>

        <td>
          * Manage [panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to the cloud load balancer, as well as manage [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.viewer \{#iam-viewer}

User with access to view everything that [iam.admin](#iam-admin) manages.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with cloud load balancers</th>

        <td>
          * View [panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) and [federations](/access-control/federations/);
          * viewing user keys;
          * viewing [notifications](/account/notifications.mdx) of other users;
          * viewing [account access restrictions](/account/limit-access-to-account.mdx)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### reader \{#reader}

User with access to view everything that [`member`](#member) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud load balancers</th>

        <td>
          In the Account access scope:

          * view the list of all balancer objects and their information across all projects: load balancers, rules and HTTP policies, target groups and servers within them, and health checks
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view the list of all balancer objects and their information in the selected project: load balancers, rules and HTTP policies, target groups and servers within them, and health checks
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.admin \{#vpc-admin}

User with access to manage cloud platform networks (private networks and subnets, public subnets and public IP addresses, cloud routers), cloud firewalls, security groups, and cloud load balancers.

Assigning ports to a cloud server is not available.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud load balancers</th>

        <td>
          In the Account access scope:

          * view the list of all balancer objects and their information across all projects: load balancers, rules and HTTP policies, target groups and servers within them, and health checks;
          * viewing load balancer statistics across all projects;
          * managing load balancers, rules and HTTP policies, target groups, and health checks across all projects;
          * enabling and disabling load balancer logging across all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view the list of all balancer objects and their information in the selected project: load balancers, rules and HTTP policies, target groups and servers within them, and health checks;
          * viewing load balancer statistics in the selected project;
          * managing load balancers, rules and HTTP policies, target groups, and health checks in the selected project;
          * enabling and disabling load balancer logging in the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.viewer \{#vpc-viewer}

User with access to view everything that [`vpc.admin`](#vpc-admin) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud load balancers</th>

        <td>
          In the Account access scope:

          * view the list of all balancer objects and their information across all projects: load balancers, rules and HTTP policies, target groups and servers within them, and health checks
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view the list of all balancer objects and their information in the selected project: load balancers, rules and HTTP policies, target groups and servers within them, and health checks
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.load\_balancer.admin \{#vpc-load-balancer-admin}

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud load balancers</th>

        <td>
          In the Account access scope:

          * view the list of all balancer objects and their information across all projects: load balancers, rules and HTTP policies, target groups and servers within them, and health checks;

          * viewing load balancer statistics across all projects;

          * managing load balancer objects (except for creating a load balancer) across all projects. Creating a load balancer additionally requires one or more extra roles. These roles depend on the network where the balancer will be created:

            * [`vpc.admin`](/access-control/role-reference.mdx#vpc-admin) to create a load balancer in any subnet;
            * [`vpc.private_network.admin`](/access-control/role-reference.mdx#vpc-private-network-admin) to create a load balancer in a private subnet;
            * [`vpc.external_access.admin`](/access-control/role-reference.mdx#vpc-external-access-admin) to create a load balancer in a public subnet;
            * a combination of [`vpc.private_network.admin`](/access-control/role-reference.mdx#vpc-private-network-admin) and [`vpc.external_access.admin`](/access-control/role-reference.mdx#vpc-external-access-admin) roles to create a load balancer in a private subnet with a public IP address;

          * enabling and disabling load balancer logging across all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view the list of all balancer objects and their information in the selected project: load balancers, rules and HTTP policies, target groups and servers within them, and health checks;
          * viewing load balancer statistics in the selected project;
          * managing load balancer objects (except for creating a load balancer) in the selected project. Creating a load balancer additionally requires one or more extra roles. These roles depend on the network where the balancer will be created:

            * [`vpc.admin`](/access-control/role-reference.mdx#vpc-admin) to create a load balancer in any subnet;
            * [`vpc.private_network.admin`](/access-control/role-reference.mdx#vpc-private-network-admin) to create a load balancer in a private subnet;
            * [`vpc.external_access.admin`](/access-control/role-reference.mdx#vpc-external-access-admin) to create a load balancer in a public subnet;
            * a combination of [`vpc.private_network.admin`](/access-control/role-reference.mdx#vpc-private-network-admin) and [`vpc.external_access.admin`](/access-control/role-reference.mdx#vpc-external-access-admin) roles to create a load balancer in a private subnet with a public IP address;
          * enabling and disabling load balancer logging in the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.load\_balancer.viewer \{#vpc-load-balancer-viewer}

User with access to view everything that [`vpc.load_balancer.admin`](#vpc-load-balancer-admin) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud load balancers</th>

        <td>
          In the Account access scope:

          * view the list of all balancer objects and their information across all projects: load balancers, rules and HTTP policies, target groups and servers within them, and health checks
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * view the list of all balancer objects and their information in the selected project: load balancers, rules and HTTP policies, target groups and servers within them, and health checks
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />