Role Based Access Control (RBAC) restricts access to the capabilities of Rackspace Cloud services, including the Rackspace Monitoring API, to authorized users only. RBAC enables Rackspace Cloud customers to specify which account users of their Cloud account have access to which Rackspace Monitoring API service capabilities, based on roles defined by Rackspace. The permissions to perform certain operations in the Rackspace Monitoring API – create, read, update, delete – are assigned to specific roles. The account owner assigns these roles, either multiproduct (global) or product-specific (for example, Rackspace Monitoring only) to account users.
The account owner (identity:user-admin) can create account users on the account and then assign roles to those users. The roles grant the account users specific permissions for accessing the capabilities of the next gen Cloud Servers service. Each account has only one account owner, and that role is assigned by default to any Rackspace Cloud account when the account is created.
See the Identity API guide for information about how to perform the following tasks:
For information about implementing RBAC by using the Cloud Control Panel and other RBAC-related topics, see the following articles in the Rackspace Support how-to collection:
- Getting Started with role-based access control (RBAC)
- Managing role-based access control through Cloud Control Panel
The following table describes the roles that can be used to access the Rackspace Monitoring API.
| Role name | Role permissions |
|---|---|
| monitoring:admin | This role provides Create, Read, Update, and Delete permissions in Rackspace Monitoring, where access is granted. |
| monitoring:creator | This role provides Create, Read, and Update permissions in Rackspace Monitoring, where access is granted. |
| monitoring:observer | This role provides Read permission in Rackspace Monitoring, where access is granted. |
Additionally, two multiproduct roles apply to all products. Users with multiproduct roles inherit access to products when those products become RBAC-enabled. The following table describes these roles and their permissions.
| Role name | Role permissions |
|---|---|
| admin | This role provides Create, Read, Update, and Delete permissions in all products, where access is granted. |
| observer | This role provides Read permission in all products, where access is granted. |
The account owner can set roles for both multiproduct and Rackspace Monitoring scope, and it is important to understand how any potential conflicts between these roles are resolved. When two roles appear to conflict, the role that provides the more extensive permissions takes precedence. Therefore, admin roles take precedence over observer and creator roles, because admin roles provide more permissions.
The following table shows two examples of how potential conflicts between user roles in the Control Panel are resolved.
| Permission configuration | Control Panel permission view | Control Panel admin capabilities |
|---|---|---|
| User is assigned the following roles: multiproduct observer and Rackspace Monitoring admin | Appears that the user has only the multiproduct observer role | User can perform admin functions for Rackspace Monitoring only. The user has the observer role for the rest of the products. |
| User is assigned to the following roles: multiproduct admin and Rackspace Monitoring observer | Appears that the user has only the multiprodcut admin role | User can perform admin functions for all of the products. The Rackspace Monitoring observer role is ignored. |
API operations for Rackspace Monitoring may or may not be available to all roles. To see which operations are permitted to invoke which calls, review the Detailed permissions matrix for Rackspace Monitoring article.