NetApp Console local deployment access roles
Suggest changes
PDFs
Identity and access management (IAM) in NetApp Console local deployment provides predefined roles that you can assign to the members of your organization across different levels of your resource hierarchy. Before you assign these roles, you should understand the permissions that each role includes. Roles fall into the following categories: platform, application, and data service.
Platform roles
Platform roles grant NetApp Console local deployment administration permissions, including role assignment and user management. The Console local deployment has several platform roles.
| Platform role | Responsibilities |
|---|---|
Allows a user unrestricted access to all fleets and folders within an organization, add members to any fleet or folder, as well as perform any task and use any data service that does not have an explicit role associated with it. |
|
Allows a user unrestricted access to assigned fleets and folders. Can add members to folders or fleets they manage, as well as perform any task and use any data service or application on resources within the folder or fleet they are assigned. |
|
Allows a user to create and manage directory service federations with the Console so users can authenticate with their existing directory credentials. |
|
Allows a user to view existing directory service federations with the Console. Cannot create or manage federations. |
|
Gives the user all of admin roles. This role is designed for smaller organizations that may not need to distribute Console responsibilities across multiple users. |
|
Gives the user all viewer roles. This role is designed for smaller organizations that may not need to distribute Console responsibilities across multiple users. |
Application roles
The following is a list of roles in the application category. Each role grants specific permissions within its designated scope. Users without the required application or platform role cannot access the respective application.
| Application role | Responsibilities |
|---|---|
Provides access to alerts and monitoring tools such as the Audit page. |
|
Administer storage health and governance functions, discover storage resources, as well as modify and delete existing systems. |
|
View storage health and governance functions, as well as view previously discovered storage resources. Cannot discover, modify, or delete existing storage systems. |
|
Administer storage and health and governance functions, all permissions of the Storage admin except cannot modify or delete existing systems. |
Data service roles
The following is a list of roles in the data service category. Each role grants specific permissions within its designated scope. Users who do not have the required data service role or a platform role will be unable to access the data service.
| Data service role | Responsibilities |
|---|---|
Perform any actions in NetApp Backup and Recovery. |
|
Perform backups to local snapshots, replicate to secondary storage, and back up to object storage. |
|
Restore workloads in the Backup and Recovery. |
|
Clone applications and data in the Backup and Recovery. |
|
View Backup and Recovery information. |
|
Classification viewer |
Allows users to view NetApp Data Classification scan results. |
SnapCenter admin |
Provides the ability to back up snapshots from on-premises ONTAP clusters using NetApp Backup and Recovery for applications. A member who has this role can complete the following actions: |