---
title: "Manage access to private DNS"
sidebar_label: "Manage access to private DNS"
sidebar_position: 3
description: "How access to private DNS is governed by a role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage access to private DNS

Access to private DNS is governed by:

* [projects](/access-control/projects/about-projects.mdx) — they define access within an isolated resource group;
* role model — it defines access for [different users](/access-control/user-types.mdx) within an account and [project](/access-control/projects/about-projects.mdx). Read more about access within the role model in the [Managing access in Selectel products](/access-control/access-management.mdx).

## Access within the role model \{#access-within-roles}

### member \{#member}

A user with full access to all services. Cannot manage access for: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations in private DNS</th>

        <td>
          In the Account access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones across all projects;

          * managing private DNS across all projects:
            * managing zones (creating, updating, deleting, connecting a network to a zone, etc.);
            * managing resource records (adding, updating, deleting a record);
            * managing connections to a private DNS resolver (creating a connection, deleting a connection);

          * managing projects, their limits, and quotas;

          * billing management
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records and information about them in the selected project;

          * managing private DNS in the selected project:
            * managing zones (creating, updating, deleting, connecting a network to a zone, etc.);
            * managing resource records (adding, updating, deleting a record);
            * managing connections to a private DNS resolver (creating a connection, deleting a connection)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### billing \{#billing}

User with access to billing management and no access to service management.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations in private DNS</th>

        <td>
          * Billing management
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.admin \{#iam-admin}

A user with access to user management and no access to services or billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations in private DNS</th>

        <td>
          * Manage [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) and [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.viewer \{#iam-viewer}

User with access to view everything that [iam.admin](#iam-admin) manages.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations in private DNS</th>

        <td>
          * View [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) and [federations](/access-control/federations/);
          * viewing user keys;
          * viewing [notifications](/account/notifications.mdx) of other users;
          * viewing [account access restrictions](/account/limit-access-to-account.mdx)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### reader \{#reader}

User with access to view everything that [`member`](#member) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations in private DNS</th>

        <td>
          In the Account access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones across all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones across all projects
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.private\_network.admin \{#vpc-private-network-admin}

User with access to manage private networks, subnets, and ports, as well as private DNS.

Adding ports to a cloud server and deleting ports added to a cloud server is not available; this requires the [`member`](#member) role.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with private DNS</th>

        <td>
          In the Account access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones across all projects;

          * managing private DNS across all projects:
            * managing zones (creating, updating, deleting, connecting a network to a zone, etc.);
            * managing resource records (adding, updating, deleting a record);
            * managing connections to a private DNS resolver (creating a connection, deleting a connection)
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records and information about them in the selected project;

          * managing private DNS in the selected project:
            * managing zones (creating, updating, deleting, connecting a network to a zone, etc.);
            * managing resource records (adding, updating, deleting a record);
            * managing connections to a private DNS resolver (creating a connection, deleting a connection)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.private\_network.viewer \{#vpc-private-network-viewer}

User with access to view everything that [`vpc.private_network.admin`](#vpc-private-network-admin) manages in the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with private DNS</th>

        <td>
          In the Account access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records in zones across all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing information about connecting a network to a private DNS resolver, viewing the list of zones and resource records and information about them in the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />