NetApp Console access roles
Suggest changes
PDFs
Identity and access management (IAM) in the NetApp Console provides predefined roles that you can assign to the members of your organization across different levels of your resource hierarchy. Before you assign these roles, you should understand the permissions that each role includes. Roles fall into the following categories: platform, application, and data service. The tables also include each role’s API name for customers who manage role assignments using the API.
Platform roles
Platform roles grant NetApp Console administration permissions, including role assignment and user management. The Console has several platform roles.
*API name is the role identifier used in APIs. Copy the value exactly as shown (including capitalization and underscores).
| Platform role | API name* | Responsibilities |
|---|---|---|
ORGANIZATION_ADMIN |
Allows a user unrestricted access to all projects and folders within an organization. Can add members to any project or folder, as well as perform any task and use any data service that does not have an explicit role associated with it. |
|
FOLDER_OR_PROJECT_ADMIN |
Allows a user unrestricted access to assigned projects and folders. Can add members to folders or projects they manage, as well as perform any task and use any data service or application on resources within the folder or project they are assigned. |
|
FEDERATION_ADMIN |
Allows a user to create and manage federations with the Console, which enables single-sign on (SSO). |
|
FEDERATION_VIEWER |
Allows a user to view existing federations with the Console. Cannot create or manage federations. |
|
PARTNERSHIP_ADMIN |
Allows a user to create and manage partnerships. |
|
PARTNERSHIP_VIEWER |
Allows a user to view existing partnerships. Cannot create or manage partnerships. |
|
SUPER_ADMIN |
Gives the user a subset of admin roles. This role is designed for smaller organizations that may not need to distribute Console responsibilities across multiple users. |
|
SUPER_VIEWER |
Gives the user a subset of viewer roles. This role is designed for smaller organizations that may not need to distribute Console responsibilities across multiple users. |
Application roles
The following is a list of roles in the application category. Each role grants specific permissions within its designated scope. Users without the required application or platform role cannot access the respective application.
| Application role | API name* | Responsibilities |
|---|---|---|
GCNV_ADMIN |
Users with the Google Cloud NetApp Volumes role can discover and manage Google Cloud NetApp Volumes. |
|
GCNV_VIEWER |
Users with the Google Cloud NetApp Volumes user role can view Google Cloud NetApp Volumes. |
|
KEYSTONE_ADMIN |
Users with the Keystone admin role can create service requests. Allows users to monitor and view usage, resources, and admin details within the Keystone tenant they are accessing. |
|
KEYSTONE_VIEWER |
Users with the Keystone viewer role CANNOT create service requests. Allows users to monitor and view consumption, assets, and administrative information within the Keystone tenant they are accessing. |
|
Users with the License and subscription admin role can create, update, and delete direct licenses and marketplace subscriptions for the NetApp Console and affiliated data services. |
||
Users with the License and subscription viewer role can view direct licenses and marketplace subscriptions for the NetApp Console and affiliated data services. |
||
ONTAP Mediator setup role |
ONTAP_MEDIATOR_SETUP |
Service accounts with the ONTAP Mediator setup role can create service requests. This role is required in a service account to configure an instance of the ONTAP Cloud Mediator. |
OPERATIONS_SUPPORT_ANALYST |
Provides access to alerts and monitoring tools and ability to enter and manage support cases. |
|
STORAGE_ADMIN |
Administer storage health and governance functions, discover storage resources, as well as modify and delete existing systems. |
|
STORAGE_VIEWER |
View storage health and governance functions, as well as view previously discovered storage resources. Cannot discover, modify, or delete existing storage systems. |
|
SYSTEM_HEALTH_SPECIALIST |
Administer storage and health and governance functions, all permissions of the Storage admin except cannot modify or delete existing systems. |
Data service roles
The following is a list of roles in the data service category. Each role grants specific permissions within its designated scope. Users who do not have the required data service role or a platform role will be unable to access the data service.
| Data service role | API name* | Responsibilities |
|---|---|---|
BACKUP_SUPER_ADMIN |
Perform any actions in NetApp Backup and Recovery. |
|
BACKUP_ADMIN |
Perform backups to local snapshots, replicate to secondary storage, and back up to object storage. |
|
RESTORE_ADMIN |
Restore workloads in Backup and Recovery. |
|
CLONE_ADMIN |
Clone applications and data in Backup and Recovery. |
|
BACKUP_VIEWER |
View Backup and Recovery information. |
|
DISASTER_RECOVERY_ADMIN |
Perform any actions in NetApp Disaster Recovery service. |
|
DISASTER_RECOVERY_FAILOVER_ADMIN |
Perform failover and migrations. |
|
DISASTER_RECOVERY_APPLICATION_ADMIN |
Create replication plans, change replication plans, and start test failovers. |
|
DISASTER_RECOVERY_VIEWER |
View information only. |
|
Required for installing Data Classification and for associating organization-level permissions in Data Classification. |
||
CLASSIFICATION_VIEWER |
Allows users to view NetApp Data Classification scan results. Users with this role can view compliance information and generate reports for resources that they have permission to access. These users can't enable or disable scanning of volumes, buckets, or database schemas. |
|
RANSOMWARE_PROTECTION_ADMIN |
Manage actions on the Protect, Alerts, Recover, Settings, and Reports tabs of NetApp Ransomware Resilience. |
|
RANSOMWARE_PROTECTION_VIEWER |
View workload data, view alert data, download recovery data, and download reports in Ransomware Resilience. |
|
RANSOMWARE_RESILIENCE_USER_BEHAVIOR_ADMIN |
Configure, manage, and view suspicious user behavior detection, alerts, and monitoring in Ransomware Resilience. |
|
RANSOMWARE_RESILIENCE_USER_BEHAVIOR_VIEWER |
View suspicious user behavior alerts and insights in Ransomware Resilience. |
|
SnapCenter admin |
SNAPCENTER_ADMIN |
Provides the ability to back up snapshots from on-premises ONTAP clusters using NetApp Backup and Recovery for applications. A member who has this role can complete the following actions: |