public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docs: Document fine-grained access control (#33563)

Browse Source
This commit is contained in:
Vardan Torosyan
2021-05-20 09:53:34 -07:00
committed by GitHub
parent 292789ba2d
commit 676ddac088
31 changed files with 1436 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/permissions/_index.md
+4
View File
@@ -8,6 +8,8 @@ weight = 50
# Permissions
> Refer to [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) in Grafana Enterprise for managing access with fine-grained permissions.
What you can do in Grafana is defined by the _permissions_ associated with your user account.
There are three types of permissions:
@@ -23,6 +25,8 @@ You can be granted permissions based on:
- (Grafana Enterprise) Data source permissions. For more information, refer to [Data source permissions]({{< relref "../enterprise/datasource_permissions.md" >}}) in [Grafana Enterprise]({{< relref "../enterprise" >}}).
- (Grafana Cloud) Grafana Cloud has additional roles. For more information, refer to [Grafana Cloud roles and permissions](/docs/grafana-cloud/cloud-portal/cloud-roles/).
If you are running Grafana Enterprise, you can grant access by using fine-grained roles and permissions, refer to [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) for more information.
## Grafana Server Admin role
Grafana server administrators have the **Grafana Admin** flag enabled on their account. They can access the **Server Admin** menu and perform the following tasks:
docs/sources/permissions/organization_roles.md
+4
View File
@@ -7,6 +7,8 @@ weight = 100
# Organization roles
> Refer to [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) in Grafana Enterprise for managing Organization roles with fine-grained permissions.
Users can belong to one or more organizations. A user's organization membership is tied to a role that defines what the user is allowed to do in that organization. Grafana supports multiple _organizations_ in order to support a wide variety of deployment models, including using a single Grafana instance to provide service to multiple potentially untrusted organizations.
In most cases, Grafana is deployed with a single organization.
@@ -36,6 +38,8 @@ The table below compares what each role can do. Read the sections below for more
| Change team settings | x | | |
| Configure app plugins | x | | |
If you are running Grafana Enterprise, you can grant and revoke access by using fine-grained roles and permissions, refer to [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) for more information.
## Organization admin role
Can do everything scoped to the organization. For example:
docs/sources/permissions/restricting-access.md
+2
View File
@@ -5,6 +5,8 @@ weight = 500
# Restricting access
> Refer to [Fine-grained access Control]({{< relref "../enterprise/access-control/_index.md" >}}) in Grafana Enterprise to understand how to use fine-grained permissions to restrict access.
The highest permission always wins so if you for example want to hide a folder or dashboard from others you need to remove the **Organization Role** based permission from the Access Control List (ACL).
- You cannot override permissions for users with the Organization Admin role. Admins always have access to everything.