RBAC
What is Role Based Access Control (RBAC)
The Humanitec Platform Orchestrator allows developers in your team or from across your Organization to collaborate on tasks related to delivering software. Users can be invited to join a Humanitec Organization. They can sign in using one of the supported authentication methods . Users can work on specific Apps with permissions to perform certain actions such as Deploy to Production based on Roles that are granted by Organization Administrators and Managers.
When planning your RBAC strategy it is best practice to follow the “Principle Of Least Privilege” (POLP). The idea is that any user of a system should only have the minimum set of permissions necessary to get their job done.
Role Types
You can set roles in an Organization , Application , or Environment Type .
In the roles overview below, the role’s ID must be used when handling roles in the Platform Orchestrator API or the Humanitec Terraform Provider .
Organization level roles
Organization Roles cover permissions that affect the entire Organization in Humanitec. This includes User Management, API Tokens, Images, Resources, and Apps.
| Role | ID | Description |
|---|---|---|
| Member | member |
Can access Apps they have a Role for. |
| Artefact Contributor | artefactContributor |
Same as the Member Role. In addition, can add image builds. The “Artefact Contributor” role can only be assigned to service users . |
| Manager | manager |
Same as the Member Role. In addition, can invite and remove Users from the Organization in Humanitec and create Apps. |
| Administrator | administrator |
Has full access to everything within the Organization in Humanitec. |
Notes
- The User who originally created the Organization will have the Administrator Role by default.
- There must always be at least one User in the Organization with the Administrator Role.
- The Administrator is the only Role that can update Resources.
Application level roles
Application Roles cover permissions that affect a specific App.
| Role | ID | Description |
|---|---|---|
| Viewer | viewer |
Has read-only access to the App. |
| Developer | developer |
Can update Configuration, Shared Values and Secrets, create and delete Environments. |
| Owner | owner |
Same as the Developer Role, but can additionally configure Webhooks, invite and remove Users from the App and delete the App. |
Example
- A User with the Developer Role is able to update the configuration for an App the User has access to. But the User cannot delete the App.
- A User with the Viewer Role will not be able to make updates to the configuration.
Notes
- The User who originally created the App will have the Owner Role by default.
- Developer and Owner Roles can only create, delete, or deploy to Environments with the Environment Type they have the Deployer Role for.
- An Owner will not be able to delete an App unless they have the Deployer Role for all the Environment Types used in the App.
Environment type level roles
At this time, there is only one Role for Environment Types.
| Role | ID | Description |
|---|---|---|
| Deployer | deployer |
If a User has the Developer or Owner Role of an App, they can create, deploy, and delete Environments of this Environment Type. |
Managing access with Roles
Humanitec uses Roles to assign privileges to Users in a system. Roles encapsulate the granular permissions that a User will need in order to perform certain tasks associated with their job. Read more on how to manage User’s Organization , Application , and Environment Type level roles.