Preliminary considerations
When using Aruba Cloud services, make sure you manage roles and permissions carefully: this is essential for protecting data and keeping your infrastructure secure.
What roles and permissions are and how they are related
Roles and permissions are closely related but distinct:
Permissions - what you can do
Permissions define the actions you can perform on an Aruba Cloud service. They are specific authorizations, for example, to create, edit or delete resources, or to read and write data.
Roles - who can do what
Roles group multiple permissions together to make them easier to manage. Each role allows a defined set of operations to be performed, for example:
- administrator: can perform all actions;
- operator: can perform all actions except deletion;
- viewer: can only view data.
Role names may vary across different cloud environments, but the underlying principle remains the same.
Identifying permissions and roles
In Aruba Cloud services, permissions are predefined and associated with the actions you can perform.
For compute services, the management panels allow you to perform actions such as creating, renaming, editing or deleting a Cloud Server: these permissions are already included in your Cloud account.
If you use the DBaaS service, there are three preconfigured permissions (read, write and delete), which make up three distinct roles:
- liteadmin: read, write and delete;
- readwrite: read and write;
- readonly: read.
You should extend the use of roles and permissions to all services. For example, you can independently create profiles for RDP or SSH access to Cloud Servers.
The importance of assigning roles to users
When assigning roles and permissions, follow these practices to maintain control and security:
- document the rules for assigning roles within your organization;
- assign roles only to users who actually need them, following the principle of least privilege;
- never share your credentials (and associated roles) with other users, even temporarily or in an emergency;
- use different roles for different environments (development, testing, production, etc.);
- periodically review permissions to remove privileges that are no longer required;
- if a user leaves the team, immediately revoke their permissions and access.