---
title: "Manage access to security groups"
sidebar_label: "Manage access to security groups"
sidebar_position: 2
description: "How access to security groups is regulated by projects and the role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage access to security groups

Access to security groups is regulated by:

* [projects](/access-control/projects/about-projects.mdx) — define access within an isolated group of resources;
* [role-based model](#access-within-roles) — determines access of [different users](/access-control/user-types.mdx) within an account and a [project](/access-control/projects/about-projects.mdx).

## Access within the role model \{#access-within-roles}

Learn more about access within the role-based model in the [Access management in Selectel products](/access-control/access-management/) instructions.

### member \{#member}

User with full access to all services. Cannot manage access for: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects;
          * creating and deleting security groups in all projects;
          * editing the name, description, and tags of a group in all projects;
          * assigning a group to a port and detaching a group from a port in all projects;
          * adding and removing rules in a group in all projects;
          * downloading the security group report for all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project;
          * creating and deleting a security group in the selected project;
          * editing the name, description, and tags of a group in the selected project;
          * assigning a group to a port and detaching a group from a port in the selected project;
          * adding and removing rules in a group in the selected project;
          * downloading the security group report for the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.admin \{#iam-admin}

User with access to user management and without access to services and billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with security groups</th>

        <td>
          * Managing [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to security groups, and managing [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### iam.viewer \{#iam-viewer}

User with access to view everything managed by [iam.admin](#iam-admin).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with security groups</th>

        <td>
          * Viewing [control panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/), and [federations](/access-control/federations/);
          * viewing user keys;
          * view [notifications](/account/notifications/notification-center.mdx) of other users;
          * viewing [account access restrictions](/account/limit-access-to-account.mdx)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### reader \{#reader}

User with access to view everything managed by [`member`](#member) in the same scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.admin \{#vpc-admin}

User with access to manage cloud platform networks (private networks and subnets, public subnets and public IP addresses, cloud routers), cloud firewalls, security groups, and cloud load balancers.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects;
          * creating and deleting security groups in all projects;
          * editing the name, description, and tags of a group in all projects;
          * assigning a group to a port and detaching a group from a port in all projects;
          * adding and removing rules in a group in all projects;
          * downloading the security group report for all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project;
          * creating and deleting a security group in the selected project;
          * editing the name, description, and tags of a group in the selected project;
          * assigning a group to a port and detaching a group from a port in the selected project;
          * adding and removing rules in a group in the selected project;
          * downloading the security group report for the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.viewer \{#vpc-viewer}

User with access to view everything managed by [`vpc.admin`](#vpc-admin) in the same scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects;
          * downloading the security group report for all projects
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project;
          * downloading the security group report for the selected project
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.network_security.admin \{#vpc-network-security-admin}

Manage tools for traffic restriction — cloud firewalls, security groups.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects (viewing port information additionally requires the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) or [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) role);
          * creating and deleting security groups in all projects;
          * editing the name, description, and tags of security groups in all projects;
          * assigning security groups to ports and detaching security groups from ports in all projects (additionally requires the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) or [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) role);
          * adding and removing rules in a security group;
          * downloading a security group report in all projects (additionally requires a combination of the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) and [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) roles, or the [`vpc.viewer`](/access-control/role-reference.mdx#vpc-viewer) role)
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project (viewing port information additionally requires the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) or [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) role);
          * creating and deleting a security group in the selected project;
          * editing the name, description, and tags of a security group in the selected project;
          * assigning a security group to a port and detaching the group from a port in the selected project (additionally requires the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) or [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) role);
          * adding and removing rules in a security group in the selected project;
          * downloading a security group report in the selected project (additionally requires a combination of the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) and [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) roles, or the [`vpc.viewer`](/access-control/role-reference.mdx#vpc-viewer) role)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.network_security.user \{#vpc-network-security-user}

User with access to view everything managed by [`vpc.network_security.admin`](#vpc-network-security-admin) in the same scope. Also has access to managing security groups on ports in a private or public network.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects;
          * assigning a group to a port and detaching a group from a port in all projects. In the [Control panel](https://my.selectel.ru/vpc/default/security-groups), this action is available for the role only through the security group page (in the top menu, click **Products** → **Cloud Servers** → **Security Groups** → group page);
          * downloading a security group report in all projects (additionally requires a combination of the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) and [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) roles, or the [`vpc.viewer`](/access-control/role-reference.mdx#vpc-viewer) role)
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project;
          * assigning a group to a port and detaching a group from a port in the selected project;
          * downloading a security group report in the selected project (additionally requires a combination of the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) and [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) roles, or the [`vpc.viewer`](/access-control/role-reference.mdx#vpc-viewer) role)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

### vpc.network_security.viewer \{#vpc-network-security-viewer}

User with access to view everything managed by [`vpc.network_security.admin`](#vpc-network-security-admin) in the same scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Who can be assigned</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with security groups</th>

        <td>
          In the Account access scope:

          * viewing the list of security groups and information about them in all projects;
          * downloading a security group report in all projects (additionally requires a combination of the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) and [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) roles, or the [`vpc.viewer`](/access-control/role-reference.mdx#vpc-viewer) role)
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope:

          * viewing the list of security groups and information about them in the selected project;
          * downloading a security group report in the selected project (additionally requires a combination of the [`vpc.private_network.viewer`](/access-control/role-reference.mdx#vpc-private-network-viewer) and [`vpc.external_access.viewer`](/access-control/role-reference.mdx#vpc-external-access-viewer) roles, or the [`vpc.viewer`](/access-control/role-reference.mdx#vpc-viewer) role)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />