diff --git a/docs/sources/administration/data-source-management/index.md b/docs/sources/administration/data-source-management/index.md
index 3ac639e7a64..df358ae042d 100644
--- a/docs/sources/administration/data-source-management/index.md
+++ b/docs/sources/administration/data-source-management/index.md
@@ -40,7 +40,8 @@ For links to data source-specific documentation, see [Data sources]({{< relref "
## Data source permissions
-You can configure data source permissions to allow or deny certain users the ability to query or edit a data source. Each data source’s configuration includes a Permissions tab where you can restrict data source permissions to specific users, teams, or roles.
+You can configure data source permissions to allow or deny certain users the ability to query, edit, or administrate a data source. Each data source’s configuration includes a Permissions tab where you can restrict data source permissions to specific users, teams, or roles.
+Query permission allows users to query the data source. Edit permission allows users to query the data source, edit the data source’s configuration and delete the data source. Admin permission allows users to query and edit the data source, change permissions on the data source and enable or disable query caching for the data source.
{{% admonition type="note" %}}
Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud](/docs/grafana-cloud).
@@ -52,7 +53,7 @@ By default, data sources in an organization can be queried by any user in that o
### Assign data source permissions to users, teams, or roles
-You can assign data source permissions to users, teams, and roles which will allow access to query or edit the data source.
+You can assign data source permissions to users, teams, and roles which will allow access to query, edit, or administrate the data source.
1. Click **Connections** in the left-side menu.
1. Under Your connections, click **Data sources**.
@@ -60,7 +61,7 @@ You can assign data source permissions to users, teams, and roles which will all
1. On the Permissions tab, click **Add a permission**.
1. Select **User**, **Team**, or **Role**.
1. Select the entity for which you want to modify permissions.
-1. Select the **Query** or **Edit** permission.
+1. Select the **Query**, **Edit**, or **Admin** permission.
1. Click **Save**.
diff --git a/docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md b/docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
index 77e2aa44d83..b6b79715c66 100644
--- a/docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
+++ b/docs/sources/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/index.md
@@ -65,6 +65,7 @@ The following tables list permissions associated with basic and fixed roles.
| `fixed:datasources.insights:reader` | `datasources.insights:read` | Read data source insights data. |
| `fixed:datasources.permissions:reader` | `datasources.permissions:read` | Read data source permissions. |
| `fixed:datasources.permissions:writer` | All permissions from `fixed:datasources.permissions:reader` and
`datasources.permissions:write` | Create, read, or delete permissions of a data source. |
+| `fixed:datasources:creator` | `datasources:create` | Create data sources. |
| `fixed:datasources:reader` | `datasources:read`
`datasources:query` | Read and query data sources. |
| `fixed:datasources:writer` | All permissions from `fixed:datasources:reader` and
`datasources:create`
`datasources:write`
`datasources:delete` | Read, query, create, delete, or update a data source. |
| `fixed:folders.permissions:reader` | `folders.permissions:read` | Read all folder permissions. |
@@ -96,6 +97,7 @@ The following tables list permissions associated with basic and fixed roles.
| `fixed:settings:reader` | `settings:read` | Read Grafana instance settings. |
| `fixed:settings:writer` | All permissions from `fixed:settings:reader` and
`settings:write` | Read and update Grafana instance settings. |
| `fixed:stats:reader` | `server.stats:read` | Read Grafana instance statistics. |
+| `fixed:teams:reader` | `teams:read` | List all teams. |
| `fixed:teams:creator` | `teams:create`
`org.users:read` | Create a team and list organization users (required to manage the created team). |
| `fixed:teams:writer` | `teams:create`
`teams:delete`
`teams:read`
`teams:write`
`teams.permissions:read`
`teams.permissions:write` | Create, read, update and delete teams and manage team memberships. |
| `fixed:users:reader` | `users:read`
`users.quotas:read`
`users.authtoken:read`
` | Read all users and their information, such as team memberships, authentication tokens, and quotas. |
diff --git a/pkg/api/accesscontrol.go b/pkg/api/accesscontrol.go
index e3d5265229a..2ba234c8a69 100644
--- a/pkg/api/accesscontrol.go
+++ b/pkg/api/accesscontrol.go
@@ -119,6 +119,21 @@ func (hs *HTTPServer) declareFixedRoles() error {
datasourcesReaderRole.Grants = []string{string(org.RoleViewer)}
}
+ datasourcesCreatorRole := ac.RoleRegistration{
+ Role: ac.RoleDTO{
+ Name: "fixed:datasources:creator",
+ DisplayName: "Data source creator",
+ Description: "Create data sources.",
+ Group: "Data sources",
+ Permissions: []ac.Permission{
+ {
+ Action: datasources.ActionCreate,
+ },
+ },
+ },
+ Grants: []string{},
+ }
+
datasourcesWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:datasources:writer",
@@ -256,6 +271,19 @@ func (hs *HTTPServer) declareFixedRoles() error {
Grants: teamCreatorGrants,
}
+ teamsReaderRole := ac.RoleRegistration{
+ Role: ac.RoleDTO{
+ Name: "fixed:teams:read",
+ DisplayName: "Team reader",
+ Description: "List all teams.",
+ Group: "Teams",
+ Permissions: []ac.Permission{
+ {Action: ac.ActionTeamsRead, Scope: ac.ScopeTeamsAll},
+ },
+ },
+ Grants: []string{},
+ }
+
teamsWriterRole := ac.RoleRegistration{
Role: ac.RoleDTO{
Name: "fixed:teams:writer",
@@ -520,12 +548,13 @@ func (hs *HTTPServer) declareFixedRoles() error {
}
roles := []ac.RoleRegistration{provisioningWriterRole, datasourcesReaderRole, builtInDatasourceReader, datasourcesWriterRole,
- datasourcesIdReaderRole, orgReaderRole, orgWriterRole,
- orgMaintainerRole, teamsCreatorRole, teamsWriterRole, datasourcesExplorerRole,
+ datasourcesIdReaderRole, datasourcesCreatorRole, orgReaderRole, orgWriterRole,
+ orgMaintainerRole, teamsCreatorRole, teamsWriterRole, teamsReaderRole, datasourcesExplorerRole,
annotationsReaderRole, dashboardAnnotationsWriterRole, annotationsWriterRole,
dashboardsCreatorRole, dashboardsReaderRole, dashboardsWriterRole,
foldersCreatorRole, foldersReaderRole, foldersWriterRole, apikeyReaderRole, apikeyWriterRole,
publicDashboardsWriterRole, featuremgmtReaderRole, featuremgmtWriterRole}
+
if hs.Features.IsEnabled(featuremgmt.FlagLibraryPanelRBAC) {
roles = append(roles, libraryPanelsCreatorRole, libraryPanelsReaderRole, libraryPanelsWriterRole, libraryPanelsGeneralReaderRole, libraryPanelsGeneralWriterRole)
}
diff --git a/pkg/services/datasources/service/datasource.go b/pkg/services/datasources/service/datasource.go
index 5d6f6925796..fe193937529 100644
--- a/pkg/services/datasources/service/datasource.go
+++ b/pkg/services/datasources/service/datasource.go
@@ -229,7 +229,7 @@ func (s *Service) AddDataSource(ctx context.Context, cmd *datasources.AddDataSou
{BuiltinRole: "Editor", Permission: "Query"},
}
if cmd.UserID != 0 {
- permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{UserID: cmd.UserID, Permission: "Edit"})
+ permissions = append(permissions, accesscontrol.SetResourcePermissionCommand{UserID: cmd.UserID, Permission: "Admin"})
}
_, err = s.permissionsService.SetPermissions(ctx, cmd.OrgID, dataSource.UID, permissions...)
return err
diff --git a/public/app/features/datasources/state/navModel.ts b/public/app/features/datasources/state/navModel.ts
index d0b76822886..c68e547b7f0 100644
--- a/public/app/features/datasources/state/navModel.ts
+++ b/public/app/features/datasources/state/navModel.ts
@@ -72,7 +72,7 @@ export function buildNavModel(dataSource: DataSourceSettings, plugin: GenericDat
}
if (featureEnabled('dspermissions.enforcement')) {
- if (contextSrv.hasPermission(AccessControlAction.DataSourcesPermissionsRead)) {
+ if (contextSrv.hasPermissionInMetadata(AccessControlAction.DataSourcesPermissionsRead, dataSource)) {
navModel.children!.push(dsPermissions);
}
} else if (highlightsEnabled && !isLoadingNav) {