User types and roles

Access rights of users are delimited through:

user types which determine where the account will be used — in the control panel or for authorized access via API and automation tools;
roles that define the accesses within each user type.

Add и edit users can only be added and edited by users with the Account Owner or User Administrator role.

You can also add users to groups to manage multiple users as one.

User types and roles are temporarily unsupported in the following product and service groups:

VMware-based cloud: VMware-based public cloud, disaster recovery to VMware-based cloud, and others;
network services (except CDN and DNS hosting);
additional services: monitoring and others besides the mobile farm.

In S3, a user's access to a buck can be changed according to the access policy, more details in the Manage Access in S3 instructions.

You can work with users and roles in the control panel, using the IAM API or Terraform.

Types of users

The user type is specified when the user is added and cannot be changed:

control panel user — a user with an account in the control panel, who registers in the control panel and undergoes two-step authentication via email and phone number during authorization . Can issue a static token (X-Token) to himself/herself for full access to Selectel products API;
service user — a user with an account for program access via Selectel product API and other automation tools. Has only a login and password. Does not have access to the control panel;
federated user — a control panel user who belongs to one of the federations and authenticates through SSO. It does not pass two-step authentication. The user is added already registered — he only needs to enter his full name at the first login. Email is mandatory. Does not have access to API.

For more information about authenticating different types of users in the API, see the API Documentation API Request Authentication instructions.

Roles

Depending on the type of user, one or more roles can be assigned to the user.

A role can be assigned to an individual user or a group of users.

		Control panel user	Service user	Federated user
Account owner	The user who registered the account. You cannot change the role of the Account Owner or assign this role to another user. You can only change the Account Owner by registering a new account	✓	✗	✗
Account administrator	User with access to account, service and billing management	✓	✓	✓
Billing administrator	User with access to billing management and without access to service management	✓	✗	✓
User Administrator	User with access to user management and without access to services and billing. The first User Administrator is created by the Account Owner	✓	✓	✓
Project Administrator	User with access to project infrastructure management and without access to billing, other projects and products	✓	✓	✓
Account Supervisor	A user with access to view all services, billing and account data and no management access. The Account Supervisor can view everything that the Account Administrator manages	✓	✓	✓
Project Observer	User with access to view project infrastructure and tickets and without management access	✓	✓	✓
S3 Administrator	User with full access to S3 management within the project. Does not have access to other products. For more details, see the Managing access in S3 manual	✗	✓	✗
User S3	A user with access to S3 bucket if they have an access policy configured that allows access to the bucket for that user, see the Manage Access in S3 instructions for details. Does not have access to other products. The degree of access and allowed actions with objects depends on the access policy settings	✗	✓	✗
Mobile farm administrator	User with full access to manage the mobile farm within the project. Does not have access to other products. More details in the Manage access to the mobile farm instructions	✓	✓	✓
Mobile farm user	User with access to use Mobile Farm devices, more details in the Manage Mobile Farm Access instructions. Does not have access to other products	✓	✓	✓
Mobile Farm Supervisor	User with access to view a list of Mobile Farm devices and consumption information, more details in the Manage Mobile Farm Access instructions. Does not have access to other products	✓	✓	✓

Role comparison

	Account owner	Account administrator	Billing administrator	User Administrator	Project Administrator	Account Supervisor	Project Observer	S3 Administrator	User S3	Mobile farm administrator	Mobile farm user	Mobile Farm Supervisor
Two-factor authentication	✓	✓	✓	✓	✓	✓	✓	✗	✗	✗	✗	✗
Viewing the authorization log	✓	✓ (only their own)	✓ (only their own)	✓ (only their own)	✓ (only their own)	✓ (only their own)	✓ (only their own)	✗	✗	✓ (only their own)	✓ (only their own)	✓ (only their own)
Resetting your sessions	✓	✓	✓	✓	✓	✓	✓	✗	✗	✓	✓	✓
Managing users, user groups and federations	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗	✗	✗
Receiving notifications	✓	✓	✓	✓	✓	✓	✓	✗	✗	✓	✓	✓
Notification management	✓ (other users only)	✗	✗	✓ (other users only)	✗	✗	✗	✗	✗	✗	✗	✗
Connect notifications in Telegram	✓	✓	✓	✓	✓	✓	✓	✗	✗	✗	✗	✗
Access restriction	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗	✗	✗

	Account owner	Account administrator	Billing administrator	User Administrator	Project Administrator	Account Supervisor	Project Observer	S3 Administrator	User S3	Mobile farm administrator	Mobile farm user	Mobile Farm Supervisor
View balance status	✓	✓	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗
Top-up	✓	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗
Transfer between balances	✓	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗
Payment for services	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗
Viewing service statuses	✓	✓	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗
Auto account management	✓	✓	✓	✗	✗	✗ (view only)	✗	✗	✗	✗	✗	✗
Managing monthly payments	✓	✓	✓	✗	✗	✗ (view only)	✗	✗	✗	✗	✗	✗
View transaction history	✓	✓	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗
Managing balance notifications	✓	✓	✓	✗	✗	✗ (view only)	✗	✗	✗	✗	✗	✗
Bank card management (adding, saving, deleting)	✓	✓	✓	✗	✗	✗ (only view saved maps)	✗	✗	✗	✗	✗	✗
Viewing reporting documents	✓	✓	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗
Withdrawal of money and affiliate program management	✓	✓	✓	✗	✗	✗ (view only)	✗	✗	✗	✗	✗	✗
Deferred payment management	✓	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗

	Account owner	Account administrator	Billing administrator	User Administrator	Project Administrator	Account Supervisor	Project Observer	S3 Administrator	User S3	Mobile farm administrator	Mobile farm user	Mobile Farm Supervisor
Service connection	✓	✓	✗	✗	✓ (in your project only)	✗	✗	✓ (in your project only)	✓ (if allowed by the access policy)	✓ (in your project only)	✗	✗
View connected services	✓	✓	✓	✗	✓ (in your project only)	✓	✓ (in your project only)	✓ (in your project only)	✓ (only within a bucket, if allowed by the access policy)	✓ (in your project only)	✓ (in your project only)	✓ (in your project only)
Payment for services	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗
Viewing service statuses	✓	✓	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗

	Account owner	Account administrator	Billing administrator	User Administrator	Project Administrator	Account Supervisor	Project Observer	S3 Administrator	User S3	Mobile farm administrator	Mobile farm user	Mobile Farm Supervisor
Resource Creation	✓	✓	✗	✗	✓ (in your project only)	✗	✗	✓ (in your project only)	✓ (if allowed by the access policy)	✓	✗	✗
View created resources	✓	✓	✓	✗	✓ (in your project only)	✓	✓ (in your project only)	✓ (in your project only)	✓ (only within a bucket, if allowed by the access policy)	✓	✓	✓
Creating, transferring and deleting projects	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗
Managing project settings	✓	✓	✗	✗	✗	✗	✗	✗	✗	✗	✗	✗
Management of project limits and quotas	✓	✓	✗	✗	✗	✗ (view only)	✗	✗	✗	✗	✗	✗
Project ticket management	✓	✓	✓	✓	✓	✓	✓	✗	✗	✗	✗	✗
Project user management	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗	✗	✗

	Account owner	Account administrator	Billing administrator	User Administrator	Project Administrator	Account Supervisor	Project Observer	S3 Administrator	User S3	Mobile farm administrator	Mobile farm user	Mobile Farm Supervisor
Manage your keys (SSH, API, S3, ADB)	✓	✓	✓	✓	✓	✓	✓	✗	✗	✓	✓	✓
Key management of other users (SSH, S3, ADB)	✓	✗	✗	✓	✗	✗	✗	✗	✗	✗	✗	✗

	Account owner	Account administrator	Billing administrator	User Administrator	Project Administrator	Account Supervisor	Project Observer	S3 Administrator	User S3	Mobile farm administrator	Mobile farm user	Mobile Farm Supervisor
Creating tickets	✓	✓	✓	✓	✓ (in your project only)	✓	✓ (in your project only)	✗	✗	✓	✓	✓
View all tickets of the account	✓	✓	✓	✓	✗	✓	✗	✗	✗	✓	✓	✓
View project tickets	✓	✓	✓	✓	✓ (in your project only)	✓	✓ (in your project only)	✗	✗	✓	✓	✓
Changing ticket availability	✓	✓	✓	✓	✓ (when a user has access to multiple projects)	✓	✓ (when a user has access to multiple projects)	✗	✗	✓	✓	✓