Updated on 2023-03-03 GMT+08:00

Role Permissions

Roles can be used for fairly coarse-grained permissions control. They grant service-level permissions based on user responsibilities. GES does not support custom roles. The following system roles are available.

Table 1 System roles

Role Name

Description

Tenant Guest

Regular tenant users

  • Permissions: querying GES resources
  • Scope: project-level service

GES Administrator

GES administrator

  • Permissions: performing any operations on GES resources
  • Scope: project-level service
    NOTE:

    If you have the Tenant Guest, Server Administrator, and VPC Administrator permissions, you can perform any operations on GES resources. If you do not have the Tenant Guest or Server Administrator permission, you cannot use GES properly.

    • If you need to bind or unbind an EIP, you need the Security Administrator permissions to create agencies.
    • If GES needs to interact with OBS, for instance, when creating and importing data, OBS permissions are required. For details, see Common GES operations supported by each OBS policy.

GES Manager

GES manager

  • Permissions: performing any operations on GES resources other than creating, deleting graphs, resizing, and expanding graphs
  • Scope: project-level service
    NOTE:

    If you have both the Tenant Guest and Server Administrator permissions, you can perform any operations on GES resources except for creating and deleting graphs. If you do not have the Tenant Guest permission, you cannot use GES properly.

    • If you need to bind or unbind an EIP, you need the Security Administrator and Server Administrator permissions.
    • If GES needs to interact with OBS, for instance, when importing data, OBS permissions are required. For details, see Common GES operations supported by each OBS policy.

GES Operator

Regular GES users

  • Permissions: viewing and accessing GES resources
  • Scope: project-level service
NOTE:

If you have both the GES Operator and Tenant Guest permissions, you can view and access GES resources. If you do not have the Tenant Guest permissions, you cannot view resources or access graphs.

To interact with OBS, for instance, to view the metadata, you need the OBS permissions. For details, see Common GES operations supported by each OBS policy.

Table 2 Common GES operations supported by each role

Operation

GES Administrator

GES Manager

GES Operator

Tenant Guest

Creating graphs

Yes

No

No

No

Deleting graphs

Yes

No

No

No

Querying graphs

Yes

Yes

Yes

Yes

Accessing graphs

Yes

Yes

Yes

No

Importing data

Yes

Yes

No

No

Creating metadata

Yes

Yes

No

No

Viewing metadata

Yes

Yes

Yes

Yes

Copying metadata

Yes

Yes

No

No

Editing metadata

Yes

Yes

No

No

Deleting metadata

Yes

Yes

No

No

Clearing data

Yes

Yes

No

No

Backing up graphs

Yes

Yes

No

No

Restoring graphs from backups

Yes

Yes

No

No

Deleting backups

Yes

Yes

No

No

Querying backups

Yes

Yes

Yes

Yes

Starting graphs

Yes

Yes

No

No

Stopping graphs

Yes

Yes

No

No

Upgrading graphs

Yes

Yes

No

No

Exporting graphs

Yes

Yes

No

No

Binding EIPs

Yes

Yes

No

No

Unbinding an EIP

Yes

Yes

No

No

Viewing results in the task center

Yes

Yes

Yes

Yes

Resizing a Graph

No

No

×

Expanding a Graph

No

No

×

Restarting a Graph

Yes

No

×

Table 3 Common GES operations supported by each OBS policy

GES Operation

Dependent OBS Permission

Viewing metadata

OBS Viewer policy or OBS Buckets Viewer role

Creating/Importing/Copying/Editing/Deleting metadata

OBS Operator policy or Tenant Administrator role

Creating, importing, and exporting graphs

OBS Operator policy or Tenant Administrator role