Roles

[edit on GitHub]

Overview

Chef Automate Identity and Access Management roles are named groups of actions used to define policies. Actions describe what is allowed by users in Automate. IAM Actions describes the associated action or actions required to access certain pages in the browser.

Users require permission for the iam:roles action to interact with roles. Any user that is part of the admins team or the Administrator policy will have this permission. Otherwise, IAM custom policies can be created to assign this permission.

Chef-Managed Roles

Chef-managed roles are roles provided by Chef that cannot be changed.

Actions for Chef-Managed Roles

Custom Roles

Custom roles are roles that any user with the permission for iam:roles:update can change. In addition to the Chef-managed roles above, Chef Automate includes two custom roles by default.

You can edit these custom roles like other user-created custom roles.

Managing Roles

Creating Roles

Custom roles can only be created using the Roles API.

Example Custom Role

{
  "name": "Advocate",
  "id": "advocate-role",
  "actions": [
    "infra:*",
    "compliance:*",
    "teams:*",
    "users:*"
  ],
  "projects": [
    "east-region",
    "west-region"
  ]
}

Changing Role Details

For custom roles, use the Roles API to change the role name, actions list, and projects.

Deleting Roles

Navigate to Roles in the Settings tab. Then open the menu at the end of the table row and select Delete Role.