---
title: "Manage access to cloud servers and flavors"
sidebar_label: "Manage server access"
sidebar_position: 1
description: "How access to cloud servers and flavors is governed by a role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from 'docs-kit/components'
import {CustomTable} from 'docs-kit/components'

# Manage access to cloud servers and flavors

Access to cloud servers and flavors is regulated by a role model that defines access within an account and [project](/access-control/projects/about-projects.mdx). Read more in the [Access Control in Selectel Products](/access-control/access-management.mdx) manual.

## member \{#member}

User with full access to all services. Does not have access to manage: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings;
          * viewing statistics for cloud servers;
          * managing cloud servers:

            * creating cloud servers;
            * changing cloud server configurations;
            * changing the OS administrator password;
            * adding and removing private and public IP addresses;
            * adding and removing cloud server ports;
            * adding and removing security groups;
            * creating cloud server backups;
            * creating cloud server images;
            * connecting and disconnecting network volumes to cloud servers;
            * powering on and off cloud servers;
            * enabling and disabling the Rescue mode for cloud servers;
            * adding and removing cloud server tags;
            * adding and removing cloud servers from a placement group;
            * pausing and freezing cloud servers;
            * resuming cloud servers after pausing or freezing;
            * rebuilding cloud servers;
            * restoring cloud servers after soft deletion;
            * deleting cloud servers;
          * using the console;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * managing flavors:

            * creating private flavors;
            * configuring access to flavors in projects;
            * deleting flavors;
          * viewing the list of SSH keys and information about them;
          * managing SSH keys:

            * creating or importing SSH keys;
            * deleting SSH keys;
          * viewing the list of placement groups and information about them: group name, placement policy condition;
          * managing placement groups:

            * creating placement groups;
            * deleting placement groups
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings;
          * viewing statistics for cloud servers;
          * managing cloud servers:

            * creating cloud servers;
            * changing cloud server configurations;
            * changing the OS administrator password;
            * adding and removing IP addresses, public IP addresses;
            * adding and removing cloud server ports;
            * adding and removing security groups;
            * creating cloud server backups;
            * creating cloud server images;
            * connecting and disconnecting network volumes to cloud servers;
            * powering on and off cloud servers;
            * enabling and disabling the Rescue mode for cloud servers;
            * adding and removing cloud server tags;
            * adding and removing cloud servers from a placement group;
            * pausing and freezing cloud servers;
            * resuming cloud servers after pausing or freezing;
            * rebuilding cloud servers;
            * restoring cloud servers after soft deletion;
            * deleting cloud servers;
          * using the console;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * managing flavors:

            * creating private flavors;
            * configuring access to flavors in projects;
            * deleting flavors;
          * viewing the list of SSH keys and information about them;
          * managing SSH keys:

            * creating or importing SSH keys;
            * deleting SSH keys;
          * viewing the list of placement groups and information about them: group name, placement policy condition;
          * managing placement groups:

            * creating placement groups;
            * deleting placement groups
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## reader \{#reader}

A user with access to view everything managed by [`member`](#member) in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * viewing the list of SSH keys and information about them;
          * viewing the list of placement groups and information about them: group name, placement policy condition
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * viewing the list of SSH keys and information about them;
          * viewing the list of placement groups and information about them: group name, placement policy condition
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## billing \{#billing}

A user with access to billing management and no access to service management.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with cloud servers</th>

        <td>
          * billing management
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.admin \{#iam-admin}

User with access to user management and no access to services or billing. Cannot manage their own account: change permissions, manage notifications, or delete a user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with cloud servers and flavors</th>

        <td>
          * manage [users](/access-control/user-types.mdx#users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to cloud servers and flavors;
          * managing [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.viewer \{#iam-viewer}

A user with access to view everything managed by [`iam.admin`](#iam-admin).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with cloud servers and flavors</th>

        <td>
          * viewing [users](/access-control/user-types.mdx#users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/);
          * viewing [federations](/access-control/federations/);
          * viewing user keys;
          * viewing [notifications](/account/notifications.mdx) of other users;
          * viewing [account access restrictions](/account/limit-access-to-account.mdx)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## compute.admin \{#compute-admin}

User with access to cloud server, flavor, and placement group management. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * managing cloud servers:

            * creating cloud servers;
            * changing cloud server configurations;
            * changing the OS administrator password;
            * adding and removing private and public IP addresses `*`;
            * adding and removing cloud server ports `*`;
            * adding and removing security groups `*`;
            * creating cloud server backups;
            * creating cloud server images;
            * connecting and disconnecting network volumes to cloud servers;
            * powering on and off cloud servers;
            * enabling and disabling the Rescue mode for cloud servers;
            * adding and removing cloud server tags;
            * adding and removing cloud servers from a placement group;
            * pausing and freezing cloud servers;
            * resuming cloud servers after pausing or freezing;
            * rebuilding cloud servers;
            * restoring cloud servers after soft deletion;
            * deleting cloud servers;
          * using the console;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * managing flavors:

            * creating private flavors;
            * configuring access to flavors in projects;
            * deleting flavors;
          * viewing the list of SSH keys and information about them;
          * managing SSH keys:

            * creating or importing SSH keys;
            * deleting SSH keys;
          * viewing the list of placement groups and information about them: group name, placement policy condition;
          * managing placement groups:

            * creating placement groups;
            * deleting placement groups
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * managing cloud servers:

            * creating cloud servers;
            * changing cloud server configurations;
            * changing the OS administrator password;
            * adding and removing private and public IP addresses `*`;
            * adding and removing cloud server ports `*`;
            * adding and removing security groups `*`;
            * creating cloud server backups;
            * creating cloud server images;
            * connecting and disconnecting network volumes to cloud servers;
            * powering on and off cloud servers;
            * enabling and disabling the Rescue mode for cloud servers;
            * adding and removing cloud server tags;
            * adding and removing cloud servers from a placement group;
            * pausing and freezing cloud servers;
            * resuming cloud servers after pausing or freezing;
            * rebuilding cloud servers;
            * restoring cloud servers after soft deletion;
            * deleting cloud servers;
          * using the console;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * managing flavors:

            * creating private flavors;
            * configuring access to flavors in projects;
            * deleting flavors;
          * viewing the list of SSH keys and information about them;
          * managing SSH keys:

            * creating or importing SSH keys;
            * deleting SSH keys;
          * viewing the list of placement groups and information about them: group name, placement policy condition;
          * managing placement groups:

            * creating placement groups;
            * deleting placement groups
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

`*` In addition to the `compute.admin` role, the user must have a role with access to manage [cloud platform networks](/cloud-servers/cloud-networks/manage-access.mdx).

## compute.viewer \{#compute-viewer}

User with access to view cloud servers, flavors, and placement groups. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * viewing the list of SSH keys and information about them;
          * viewing the list of placement groups and information about them: group name, placement policy condition
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * viewing the list of SSH keys and information about them;
          * viewing the list of placement groups and information about them: group name, placement policy condition
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## compute.server.user \{#compute-server-user}

User with access to manage cloud servers. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * managing cloud servers:

            * changing the OS administrator password;
            * adding and removing private and public IP addresses `*`;
            * adding and removing cloud server ports `*`;
            * adding and removing security groups `*`;
            * creating cloud server backups `*`;
            * creating cloud server images `*`;
            * connecting and disconnecting network volumes to cloud servers `*`;
            * powering on and off cloud servers;
            * enabling and disabling the Rescue mode for cloud servers `*`;
            * adding and removing cloud server tags;
            * adding and removing cloud servers from a placement group;
          * using the console;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * viewing the list of SSH keys and information about them;
          * managing SSH keys:

            * creating or importing SSH keys;
            * deleting SSH keys
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * managing cloud servers:

            * changing the OS administrator password;
            * adding and removing private and public IP addresses `*`;
            * adding and removing cloud server ports `*`;
            * adding and removing security groups `*`;
            * creating cloud server backups `*`;
            * creating cloud server images `*`;
            * connecting and disconnecting network volumes to cloud servers `*`;
            * powering on and off cloud servers;
            * enabling and disabling the Rescue mode for cloud servers `*`;
            * adding and removing cloud server tags;
            * adding and removing cloud servers from a placement group;
          * using the console;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * viewing the list of SSH keys and information about them;
          * managing SSH keys:

            * creating or importing SSH keys;
            * deleting SSH keys
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

`*` In addition to the `compute.server.user` role, the user must have a role with access to manage [cloud platform networks](/cloud-servers/cloud-networks/manage-access.mdx), [networks volumes](/cloud-servers/volumes/manage-access.mdx), [images](/cloud-servers/images/manage-access.mdx) and [backups](/cloud-servers/backups/manage-access.mdx).

## compute.server.viewer \{#compute-server-viewer}

User with access to view cloud servers. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, vCPU count, RAM, and local disk size;
          * viewing the list of SSH keys and information about them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas, modified quota values, and used quotas);
          * viewing the list of cloud servers and information about them: server type, configuration type, number of vCPU, memory size, attached volumes, security groups, network settings, tags;
          * viewing statistics for cloud servers;
          * viewing Syslog;
          * viewing the list of flavors and information about them: flavor name, vCPU count, RAM, and local disk size;
          * viewing the list of SSH keys and information about them
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## compute.flavor.admin \{#compute-flavor-admin}

User with access to manage cloud server flavors. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas);
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * managing flavors:

            * creating private flavors;
            * configuring access to flavors in projects;
            * deleting flavors;
          * viewing the list of SSH keys and information about them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas);
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size;
          * managing flavors:

            * creating private flavors;
            * configuring access to flavors in projects;
            * deleting flavors;
          * viewing the list of SSH keys and information about them
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## compute.flavor.viewer \{#compute-flavor-viewer}

User with access to view cloud server flavors. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * account;
          * project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with cloud servers and flavors</th>

        <td>
          In the Account access scope:

          * viewing all project quotas (default quotas);
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size
          * viewing the list of SSH keys and information about them
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing project quotas (default quotas);
          * viewing the list of flavors and information about them: flavor name, number of vCPU, RAM, and local disk size
          * viewing the list of SSH keys and information about them
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />