Role-based Access Control

• Assigning roles
• Resolving role conflicts between roles

RBAC roles are customer-managed roles with specific permissions that determine the services a user can access and the types of operations they can complete. For example, an account user with the lbaas:admin role has create, read, update, and delete permissions for the Cloud Load Balancer service.

All RBAC roles are subordinate to the identity:user-admin or the identity:user-manage roles that the Identity service assigns to Rackspace Cloud accounts held by the account owner or by an account designated to manage user accounts. Only Identity administrators and managers can create account users (identity:default) and assign RBAC roles. Account owners cannot hold any additional roles because they already have full access to all services and capabilities. Account managers can have both the identity:user-manage and the identity:default.

Role assignments can be global or custom. Global roles manage access and permissions across multiple API services. Custom roles manage access and permissions on a per-product basis. For both global and custom roles, the user has access only to designated products. The following table describes the RBAC roles available.

Table: Rackspace Cloud RBAC Roles and Capabilities

Assigning roles

The account owner, identity:user-admin can create account users, identity:default on the account and then assign roles to those users. The roles grant the account users specific permissions for accessing the Cloud services and capabilities. Each account has only one account owner, and that role is assigned by default to any Rackspace Cloud account when the account is created. Account owners cannot hold any additional roles because they already have full access to all services and capabilities.

You can assign roles programmatically through the API or by using the Cloud Control panel interface.

Use the following API operations to add account users and manage role assignments:

• Add account user
• Assign role to account users
• Delete role from account user

For information about implementing RBAC by using the Cloud Control Panel and other RBAC-related topics, see the following Rackspace Knowledge Center articles:

• Getting Started with role-based access control (RBAC)
• Managing role-based access control through Cloud Control Panel

Resolving role conflicts between roles

The account owner can assign both multiproduct (global) roles and custom (product-specific). In some cases, the scope of these roles can overlap and cause conflict. When conflicts occur, the role that provides the more extensive permissions takes precedence. Therefore, admin roles take precedence over observer roles, because admin roles provide more permissions.

The following table shows two examples of how potential conflicts between user role assignments are resolved:

For information about using RBAC with specific products, see the API Developer Guide for each product.