ContextQMD
Back to Redis

Create Cluster Roles

content/operate/rs/7.4/security/access-control/create-cluster-roles.md

latest5.4 KB
Original Source

Roles with cluster access allow access to the Cluster Management UI and REST API.

Default management roles

Redis Enterprise Software includes five predefined roles that determine a user's level of access to the Cluster Manager UI and [REST API]({{<relref "/operate/rs/7.4/references/rest-api">}}).

  1. DB Viewer - Read database settings
  2. DB Member - Administer databases
  3. Cluster Viewer - Read cluster settings
  4. Cluster Member - Administer the cluster
  5. Admin - Full cluster access
  6. None - For data access only - cannot access the Cluster Manager UI or use the REST API

For more details about the privileges granted by each of these roles, see Cluster Manager UI permissions or [REST API permissions]({{<relref "/operate/rs/7.4/references/rest-api/permissions">}}).

Cluster Manager UI permissions

Here's a summary of the Cluster Manager UI actions permitted by each default management role:

ActionDB ViewerDB MemberCluster ViewerCluster MemberAdmin
Create support package<span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
Edit database configuration<span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
Reset slow log<span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View cluster configuration<span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View cluster logs<span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View cluster metrics<span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View database configuration<span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View database metrics<span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View node configuration<span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View node metrics<span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View Redis database password<span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View slow log<span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span><span title="Allowed">✅ Yes</span>
View and edit cluster settings<span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Not allowed">❌ No</span><span title="Allowed">✅ Yes</span>

Create roles for cluster access {#create-cluster-role}

To create a role that grants cluster access but does not grant access to any databases:

  1. From Access Control > Roles, you can:

    • Point to a role and select {{< image filename="/images/rs/buttons/edit-button.png#no-click" alt="The Edit button" width="25px" class="inline" >}} to edit an existing role.

    • Select + Add role to create a new role.

    {{<image filename="images/rs/access-control-role-panel.png" alt="Add role with name" >}}

  2. Enter a descriptive name for the role.

  3. Choose a Cluster management role to determine cluster management permissions.

    {{<image filename="images/rs/screenshots/access-control/rbac-create-role-cluster-only.png" alt="Select a cluster management role to set the level of cluster management permissions for the new role." >}}

  4. To prevent database access when using this role, do not add any ACLs.

  5. Select Save.

You can [assign the new role to users]({{<relref "/operate/rs/7.4/security/access-control/create-users#assign-roles-to-users">}}) to grant cluster access.