VMware Aria Automation 8.16

8.18 8.17 8.16 8.14 8.13 all
Português (Brasil) 简体中文 Deutsch Español Français Italiano 日本語 한국어 Nederlands Русский 繁體中文 English

User role use case 3: Set up
VMware Aria Automation
 custom user roles to refine system roles

As a
VMware Aria Automation
 organization owner or service administrator, you manage user access using the organization and service system roles. However, you also want to create custom roles to that selected users and perform tasks or see content that is outside of their system roles.
This scenario assumes that you understand the service user and viewer, and the project member and viewer roles that are defined in use case 2. You can see that they are more restrictive than the service and project administrator roles used in use case 1. Now you have identified some local use cases where you want some users to have full management permissions to on some features, view permissions on others, and you do not want them to even view yet another set of features. You use custom roles define those permission.
This use case is based on three possible local use cases. This procedure shows you how to create permissions for the following custom roles.
  • Restricted Infrastructure Administrator. You want some service users, who are not service administrators, to have broader infrastructure permissions. As the administrator, you want them to help set up cloud zones, images, and flavors. You also want them to be able on on-board and manage discovered resources. Notice they cannot add cloud accounts or integrations, they can only define the infrastructure for those endpoints.
  • Extensibility Developer. You want some service users to have full permissions to use the extensibility actions and subscriptions as part of cloud template development for their project team and for other projects. They will also develop custom resource types and custom actions for multiple projects.
  • XaaS Developer. You want some service users to have full permissions to develop custom resource types and custom actions for multiple projects.
  • Deployment Troubleshooter. You want your project administrators to have permissions they need to troubleshoot and perform root cause analysis on failed deployments. You give them manage permissions on non-destructive or less expensive categories such as image and flavor mappings. You also want the project administrators to have permission to set approvals and day 2 policies as part of the failed deployment troubleshooting role.
  1. Assign organization member roles to your cloud template developer users.
    If you need instructions, see the first use case.
  2. Assign
    Automation Assembler
     and
    Automation Service Broker
     service roles for your cloud template developers and catalog consumers.
    If you need instructions, see the second use case.
  3. Create projects in
    Automation Assembler
     that you use to group resources and users.
    The steps below for the custom roles also includes project roles.
    If you need instructions for creating projects, see the second use case.
  4. Create and release cloud templates for each project team.
    If you need instructions, see the first use case.
  5. Log in to
    Automation Assembler
     as a service administrator and select
    Infrastructure
    Administration
    Custom Roles
    .
  6. Create a Restricted Infrastructure Administrator role.
    In this example, you have a user, Tony, who is expert at setting up the infrastructure for various projects, but you don't want to give him full service permissions. Instead, Tony builds the core infrastructure the supports the work of all the projects. You give him limited infrastructure management permissions. Tony, or an outside contractor, might also have similar permissions for onboarding discovered machines and bringing them under
    VMware Aria Automation
     management.
    1. Add Tony to
      Automation Assembler
       as a service user and viewer.
      With his viewer permissions, he can see the underlying cloud accounts and integrations if he needs to troubleshoot his work, but he cannot make changes.
    2. Create a project and add Tony as project member.
    3. To create the custom role, select
      Infrastructure
      Administration
      Custom Roles
      , and click
      New Custom Role
      .
    4. Enter the name
      Restricted Infrastructure Administrator
       and select the following permissions.
      Select this permission ...
      So that the users can ...
      Infrastructure > Manage Cloud Zones
      Create, update, and delete cloud zones.
      Infrastructure > Manage Flavor Mappings
      Create, update, and delete flavor mappings.
      Infrastructure > Manage Image Mappings
      Create, update, and delete image mappings.
      Infrastructure > Manage Network Profiles
      Create, update, or delete network profiles.
      Infrastructure > Manage Storage Profiles
      Create, update, or delete storage profiles.
      Infrastructure > Onboarding
      Create, update, or delete onboarding plans.
    5. Click
      Create
      .
    6. On the Custom Roles page, select the Restricted Infrastructure Administrator role and click
      Assign
      .
    7. Enter Tony's email account and click
      Add
      .
      For example, enter Tony@yourcompany.com.
      You can also enter any defined Active Directory user groups.
    8. Have Tony verify that when he logs in, he can add, edit, and delete values in the areas defined by the custom role.
  7. Create an Extensibility Developer role.
    In this example, you have several cloud template developers, Sylvia and Igor, who are knowledgeable about how to use extensibility actions and subscriptions to manage daily development tasks. They are also experienced with
    Automation Orchestrator
    , so you task them with providing custom resources and actions for various projects. You give them additional permissions manage extensibility by managing custom resources and actions, and by managing extensibility actions and subscriptions.
    1. Add Sylvia and Igor as
      Automation Assembler
       users.
    2. Add them as members of the projects that they are contributing their extensibility skills to.
    3. Create a custom user role that you name
      Extensibility Developer
       and select the following permissions.
      Select this permission ...
      So that the users can ...
      XaaS > Manage Custom Resources
      Create, update, or delete custom resources.
      XaaS > Manage Resource Actions
      Create, update, or delete custom actions.
      Extensibility > Manage Extensibility Resources
      Create, update, or delete extensibility actions and subscriptions. Deactivate subscriptions. Cancel and delete action runs.
    4. Click
      Create
      .
    5. Assign Sylvia and Igor to the Extensibility Developer role.
    6. Verify that Sylvia and Igor can manage the custom resources and actions, and that they can manage the various options on the Extensibility tab.
  8. Create a Deployment Troubleshooter role.
    In this example, you give your project administrators more manage permission so that they can remedy deployment failures for their teams.
    1. Add your project administrators, Shauna, Pratap, and Wei, as
      Automation Assembler
       and
      Automation Service Broker
       service users.
    2. In their projects, add them as project administrators.
    3. Create a custom user role that you name
      Deployment Troubleshooter
       and select the following permissions.
      Select this permission ...
      So that the users can ...
      Infrastructure > Manage Flavor Mappings
      Create, update, and delete flavor mappings.
      Infrastructure > Manage Image Mappings
      Create, update, and delete image mappings.
      Infrastructure > View Network Profiles
      View network profiles.
      Infrastructure > View Storage Profiles
      View storage profiles.
      Deployments > Manage Deployments
      View all deployments, across projects, and run all day 2 actions on deployments and deployment components.
      Policy > Manage Policies
      Create, update, or delete policy definitions.
    4. Click
      Create
      .
    5. Assign Shauna, Pratap, and Wei to the Deployment Troubleshooter role.
    6. Verify that they can manage flavor mappings, image mappings, and policies in
      Automation Service Broker
      .
In this use case, you configure different users with various roles, including custom roles that expand their service and project roles.
Create custom roles that address your local use cases.

Content feedback and comments