---
title: "Manage access to a global router"
sidebar_label: "Manage access to a global router"
sidebar_position: 2
description: "How access to a global router is governed by a role model"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'

# Manage access to a global router

Access to the global router is governed by a role-based model that defines access within an account and [project](/access-control/projects/about-projects.mdx). Read more in the [Access Control in Selectel Products](/access-control/access-management.mdx).

## member \{#member}

A user with full access to all services. Does not have management access to: [users](/access-control/manage/), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) and [federations](/access-control/federations/).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with a global router</th>

        <td>
          In the Account access scope:

          * Viewing a list of global routers, networks and subnets connected to them, and a list of static routes on the router;
          * creating, modifying, and deleting global routers;
          * adding, modifying, and deleting static routes on a global router;
          * renaming networks and subnets connected to a global router;
          * connecting an existing or new cloud platform network and subnet to a global router;
          * connecting an existing or new dedicated server network and subnet to a global router;
          * deleting a cloud platform network or subnet from a global router network, including deleting the cloud platform network or subnet itself;
          * deleting a dedicated server network or subnet from a global router network
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope, operations with a global router are not available
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.admin \{#iam-admin}

A user with access to user management and no access to services or billing. Cannot manage their own account: change permissions, manage notifications, or delete the user. The first user with the `iam.admin` role is created by the [Account Owner](/access-control/user-types.mdx#account-owner).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with a global router</th>

        <td>
          * Manage [panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to a global router, as well as manage [federations](/access-control/federations/)
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## iam.viewer \{#iam-viewer}

A user with access to view everything managed by [iam.admin](#iam-admin).

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          <ul>
            <li>Users;</li><li>service users;</li><li>user groups</li>
          </ul>
        </td>
      </tr>

      <tr>
        <th>Available operations with a global router</th>

        <td>
          <ul>
            <li>View [panel users](/access-control/user-types.mdx#panel-users), [service users](/access-control/user-types.mdx#service-users), [user groups](/access-control/groups/) with access to a global router, as well as view [federations](/access-control/federations/)</li>
          </ul>
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## reader \{#reader}

A user with access to view everything managed by [`member`](#member) within the same access scope.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th>

        <td>
          * Account;
          * Project
        </td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th rowspan="2">Available operations with a global router</th>

        <td>
          In the Account access scope:

          * viewing a list of global routers, connected networks and subnets, and a list of static routes on the router
        </td>
      </tr>

      <tr>
        <td>
          In the Project access scope, operations with a global router are not available
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## global\_router.admin \{#global-router-admin}

User with access to manage global routers in the account. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with a global router</th>

        <td>
          * Viewing a list of global routers, networks and subnets connected to them, and a list of static routes on the router;
          * creating, modifying, and deleting global routers;
          * adding, modifying, and deleting static routes on a global router;
          * renaming networks and subnets connected to a global router.

          For other operations with global router networks, the [`member`](#member) role is additionally required (Project or Account access scope):

          * connecting an existing or new cloud platform network and subnet to a global router;
          * connecting an existing or new dedicated server network and subnet to a global router;
          * deleting a cloud platform network or subnet from a global router network, including deleting the cloud platform network or subnet itself;
          * deleting a dedicated server network or subnet from a global router network
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## global\_router.viewer \{#global-router-viewer}

User with access to view global routers and their networks. Does not have access to other products.

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Access scopes</th><td>Account</td>
      </tr>

      <tr>
        <th>Can be assigned to</th>

        <td>
          * Users;
          * service users;
          * user groups
        </td>
      </tr>

      <tr>
        <th>Available operations with a global router</th>

        <td>
          * Viewing a list of global routers, networks and subnets connected to them, and a list of static routes on the router
        </td>
      </tr>
    </tbody>
  </table>
</CustomTable>

<Formbricks />