From d7fe097630950ab274348907c95f49c6c1593d15 Mon Sep 17 00:00:00 2001 From: Jo Date: Fri, 21 Mar 2025 10:07:52 +0100 Subject: [PATCH] Docs: Add documentation on the cloud access policy permissions (#102550) * add admonition * add to menu * add missing entry * make it prettier * fix ref --- .../custom-role-actions-scopes/index.md | 14 ++++++++++++++ .../access-control/rbac-for-app-plugins/index.md | 5 ++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md index baab890cbef..8859c8964b4 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/custom-role-actions-scopes/index.md @@ -205,6 +205,20 @@ The following list contains role-based access control actions used by Grafana Ad | `grafana-adaptive-metrics-app.exemptions:read` | None | Read recommendation exemptions. | | `grafana-adaptive-metrics-app.exemptions:write` | None | Create, update, and delete recommendation exemptions. | +### Cloud Access Policies action definitions + +The following list contains role-based access control actions used by Cloud Access Policies. + +| Action | Applicable scopes | Description | +| ------------------------ | ----------------- | ------------------------------------------------------------------- | +| `grafana-auth-app:write` | None | Create, read, update, and delete access policies for Grafana Cloud. | + +{{< admonition type="warning" >}} +Granting the `grafana-auth-app:write` permission is equivalent to assigning the Admin role to a user in Grafana, as it allows them to manage all stack service accounts. This provides significant privileges and should be assigned with caution. +{{< /admonition >}} + +For more information on Cloud Access Policies and how to use them, see [Access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/). + ### Grafana Alerting Notification action definitions To use these permissions, enable the `alertingApiServer` feature toggle. diff --git a/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md b/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md index 020bf9c982c..46304ed2000 100644 --- a/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md +++ b/docs/sources/administration/roles-and-permissions/access-control/rbac-for-app-plugins/index.md @@ -24,6 +24,9 @@ refs: destination: /docs/grafana//administration/roles-and-permissions/access-control/custom-role-actions-scopes/#grafana-adaptive-metrics-action-definitions - pattern: /docs/grafana-cloud/ destination: /docs/grafana-cloud/account-management/authentication-and-permissions/access-control/custom-role-actions-scopes/#grafana-adaptive-metrics-action-definitions + cloud-access-policies-action-definitions: + - pattern: /docs/grafana-cloud/ + destination: /docs/grafana//administration/roles-and-permissions/access-control/custom-role-actions-scopes/#cloud-access-policies-action-definitions rbac-role-definitions: - pattern: /docs/grafana/ destination: /docs/grafana//administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/ @@ -62,7 +65,7 @@ The following list contains app plugins that have fine-grained RBAC support. | App plugin | App plugin ID | App plugin permission documentation | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [Access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/) | `grafana-auth-app` | n/a | +| [Access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/) | `grafana-auth-app` | [RBAC actions for Access Policies](ref:cloud-access-policies-action-definitions) | | [Adaptive metrics](https://grafana.com/docs/grafana-cloud/cost-management-and-billing/reduce-costs/metrics-costs/control-metrics-usage-via-adaptive-metrics/adaptive-metrics-plugin/) | `grafana-adaptive-metrics-app` | [RBAC actions for Adaptive Metrics](ref:adaptive-metrics-permissions) | | [Incident](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/incident/) | `grafana-incident-app` | n/a | | [OnCall](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/oncall/) | `grafana-oncall-app` | [Configure RBAC for OnCall](https://grafana.com/docs/grafana-cloud/alerting-and-irm/irm/oncall/manage/user-and-team-management/#manage-users-and-teams-for-grafana-oncall) |