Manage private DNS access

Last update: October 13 2026Open in Markdown

Access to private DNS is governed by:

• projects — determine access within an isolated group of resources;
• role model — determines access for different users within an account and project. Learn more about access within the role model in the Access management in Selectel products instructions.

Access within the role model

member

User with full access to all services. Access management is not available: users, service users, user groups, and federations.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available operations in private DNS	In the Account access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records in zones across all projects; manage private DNS across all projects: manage zones (create, update, delete, connect a network to a zone, etc.); manage resource records (add, update, delete a record); manage connection to the private DNS resolver (create a connection, delete a connection); manage projects, their limits and quotas; manage billing
	In the Project access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records and their information in the selected project; manage private DNS in the selected project: manage zones (create, update, delete, connect a network to a zone, etc.); manage resource records (add, update, delete a record); manage connection to the private DNS resolver (create a connection, delete a connection)

billing

User with access to billing management and without access to service management.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available operations in private DNS	Manage billing

iam.admin

User with access to user management and without access to services and billing. Cannot manage their own account: change permissions, manage notifications, delete the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available operations in private DNS	Manage control panel users, service users, user groups, and federations

iam.viewer

User with access to view everything managed by iam.admin.

Access scopes	Account
Who can be assigned	Users; service users; user groups
Available operations in private DNS	View control panel users, service users, user groups, and federations; view user keys; view notifications of other users; view account access restrictions

reader

User with access to view everything managed by member in the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available operations in private DNS	In the Account access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records in zones across all projects
	In the Project access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records in zones across all projects

vpc.private_network.admin

User with access to manage private networks, subnets, and ports, as well as private DNS.

Adding ports to a cloud server and deleting ports added to a cloud server are not available; the member role is required for this.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available operations with private DNS	In the Account access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records in zones across all projects; manage private DNS across all projects: manage zones (create, update, delete, connect a network to a zone, etc.); manage resource records (add, update, delete a record); manage connection to the private DNS resolver (create a connection, delete a connection)
	In the Project access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records and their information in the selected project; manage private DNS in the selected project: manage zones (create, update, delete, connect a network to a zone, etc.); manage resource records (add, update, delete a record); manage connection to the private DNS resolver (create a connection, delete a connection)

vpc.private_network.viewer

User with access to view everything managed by vpc.private_network.admin in the same access scope.

Access scopes	Account; Project
Who can be assigned	Users; service users; user groups
Available operations with private DNS	In the Account access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records in zones across all projects
	In the Project access scope: view information about network connection to the private DNS resolver, view the list of zones and resource records and their information in the selected project