Manage access to security groups

Access to security groups is governed by:

projects — define access within an isolated resource group;
the role model — defines access of different users within an account and project.

Access within the role model

Learn more about access within the role model in the Access management in Selectel products instructions.

member

A user with full access to all services. Cannot manage access for: users, service users, user groups, and federations.

Access scopes	Account; Project
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects; creating and deleting security groups in all projects; editing the name, description, and tags of a group in all projects; assigning a group to a port and detaching a group from a port in all projects; adding and deleting rules in a group in all projects; downloading a security group report in all projects
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project; creating and deleting a security group in the selected project; editing the name, description, and tags of a group in the selected project; assigning a group to a port and detaching a group from a port in the selected project; adding and deleting rules in a group in the selected project; downloading a security group report in the selected project

iam.admin

A user with access to user management and without access to services and billing. Cannot manage their own account: change permissions, manage notifications, delete the user. The first user with the iam.admin role is created by the Account Owner.

Access scopes	Account
Can be assigned to	Users; service users; user groups
Available operations with security groups	Managing control panel users, service users, user groups with access to security groups, as well as managing federations

iam.viewer

A user with access to view everything managed by iam.admin.

Access scopes	Account
Can be assigned to	Users; service users; user groups
Available operations with security groups	Viewing control panel users, service users, user groups, and federations; viewing user keys; viewing notifications of other users; viewing account access restrictions

reader

A user with access to view everything managed by member in the same access scope.

Access scopes	Account; Project
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project

vpc.admin

A user with access to managing Cloud Platform networks (private networks and subnets, public subnets and public IP addresses, cloud routers), cloud firewalls, security groups, and cloud load balancers.

Access scopes	Account; Project
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects; creating and deleting security groups in all projects; editing the name, description, and tags of a group in all projects; assigning a group to a port and detaching a group from a port in all projects; adding and deleting rules in a group in all projects; downloading a security group report in all projects
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project; creating and deleting a security group in the selected project; editing the name, description, and tags of a group in the selected project; assigning a group to a port and detaching a group from a port in the selected project; adding and deleting rules in a group in the selected project; downloading a security group report in the selected project

vpc.viewer

A user with access to view everything managed by vpc.admin in the same access scope.

Access scopes	Account
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects; downloading a security group report in all projects
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project; downloading a security group report in the selected project

vpc.network_security.admin

Managing traffic restriction tools — cloud firewalls and security groups.

Access scopes	Account; Project
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects (viewing port information additionally requires the `vpc.private_network.viewer` or `vpc.external_access.viewer` role); creating and deleting security groups in all projects; editing the name, description, and tags of security groups in all projects; assigning security groups to ports and detaching security groups from ports in all projects (additionally requires the `vpc.private_network.viewer` or `vpc.external_access.viewer` role); adding and deleting rules in a security group; downloading a security group report in all projects (additionally requires a combination of the `vpc.private_network.viewer` and `vpc.external_access.viewer` roles, or the `vpc.viewer` role)
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project (viewing port information additionally requires the `vpc.private_network.viewer` or `vpc.external_access.viewer` role); creating and deleting a security group in the selected project; editing the name, description, and tags of a security group in the selected project; assigning a security group to a port and detaching a group from a port in the selected project (additionally requires the `vpc.private_network.viewer` or `vpc.external_access.viewer` role); adding and deleting rules in a security group in the selected project; downloading a security group report in the selected project (additionally requires a combination of the `vpc.private_network.viewer` and `vpc.external_access.viewer` roles, or the `vpc.viewer` role)

vpc.network_security.user

A user with access to view everything managed by vpc.network_security.admin in the same access scope. Also has access to managing security groups on ports in a private or public network.

Access scopes	Account; Project
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects; assigning a group to a port and detaching a group from a port in all projects. In the Control panel, the action is available for this role only via the security group page (in the top menu, click Products → Cloud Servers → Security groups → group page); downloading a security group report in all projects (additionally requires a combination of the `vpc.private_network.viewer` and `vpc.external_access.viewer` roles, or the `vpc.viewer` role)
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project; assigning a group to a port and detaching a group from a port in the selected project; downloading a security group report in the selected project (additionally requires a combination of the `vpc.private_network.viewer` and `vpc.external_access.viewer` roles, or the `vpc.viewer` role)

vpc.network_security.viewer

A user with access to view everything managed by vpc.network_security.admin in the same access scope.

Access scopes	Account; Project
Can be assigned to	Users; service users; user groups
Available operations with security groups	In the Account access scope: viewing the list of security groups and information about them in all projects; downloading a security group report in all projects (additionally requires a combination of the `vpc.private_network.viewer` and `vpc.external_access.viewer` roles, or the `vpc.viewer` role)
Available operations with security groups	In the Project access scope: viewing the list of security groups and information about them in the selected project; downloading a security group report in the selected project (additionally requires a combination of the `vpc.private_network.viewer` and `vpc.external_access.viewer` roles, or the `vpc.viewer` role)