awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: finalized permission docs

Browse Source
This commit is contained in:
Sheen
2025-03-19 19:59:50 +00:00
parent 3741201b87
commit 2d5b7afda7
5 changed files with 658 additions and 214 deletions
Download Patch File Download Diff File Expand all files Collapse all files

213
docs/internals/permissions.mdx
View File

@@ -1,213 +0,0 @@
---
title: "Permissions"
description: "Infisical's permissions system provides granular access control."
---
## Overview
The Infisical permissions system is based on a role-based access control (RBAC) model. The system allows you to define roles and assign them to users and machines. Each role has a set of permissions that define what actions a user can perform.
Permissions are built on a subject-action-object model. The subject is the resource the permission is being applied to, the action is what the permission allows.
An example of a subject/action combination would be `secrets/read`. This permission allows the subject to read secrets.
Refer to the table below for a list of subjects and the actions they support.
## Subjects and Actions
<Tabs>
<Tab title="Project Permissions">
<Note>
Not all actions are applicable to all subjects. As an example, the
`secrets-rollback` subject only supports `read`, and `create` as actions.
While `secrets` support `read`, `create`, `edit`, `delete`.
</Note>
| Subject | Actions |
| ------------------------- | ----------------------------------------------------------------------------------------------------------- |
| `role` | `read`, `create`, `edit`, `delete` |
| `member` | `read`, `create`, `edit`, `delete`, `manage-privileges` |
| `groups` | `read`, `create`, `edit`, `delete`, `manage-privileges` |
| `settings` | `read`, `create`, `edit`, `delete` |
| `integrations` | `read`, `create`, `edit`, `delete` |
| `webhooks` | `read`, `create`, `edit`, `delete` |
| `service-tokens` | `read`, `create`, `edit`, `delete` |
| `environments` | `read`, `create`, `edit`, `delete` |
| `tags` | `read`, `create`, `edit`, `delete` |
| `audit-logs` | `read`, `create`, `edit`, `delete` |
| `ip-allowlist` | `read`, `create`, `edit`, `delete` |
| `workspace` | `edit`, `delete` |
| `secrets` | `read`, `create`, `edit`, `delete` |
| `secret-folders` | `read`, `create`, `edit`, `delete` |
| `secret-imports` | `read`, `create`, `edit`, `delete` |
| `dynamic-secrets` | `read-root-credential`, `create-root-credential`, `edit-root-credential`, `delete-root-credential`, `lease` |
| `secret-rollback` | `read`, `create` |
| `secret-approval` | `read`, `create`, `edit`, `delete` |
| `secret-rotation` | `read`, `create`, `edit`, `delete` |
| `identity` | `read`, `create`, `edit`, `delete`, `manage-privileges` |
| `certificate-authorities` | `read`, `create`, `edit`, `delete` |
| `certificates` | `read`, `create`, `edit`, `delete` |
| `certificate-templates` | `read`, `create`, `edit`, `delete` |
| `pki-alerts` | `read`, `create`, `edit`, `delete` |
| `pki-collections` | `read`, `create`, `edit`, `delete` |
| `kms` | `edit` |
| `cmek` | `read`, `create`, `edit`, `delete`, `encrypt`, `decrypt` |
| `secret-syncs` | `read`, `create`, `edit`, `delete`, `sync-secrets`, `import-secrets`, `remove-secrets` |
</Tab>
<Tab title="Organization Permissions">
<Note>
Not all actions are applicable to all subjects. As an example, the `workspace`
subject only supports `read`, and `create` as actions. While `member` support
`read`, `create`, `edit`, `delete`.
</Note>
| Subject | Actions |
| ------------------- | ------------------------------------------------------------------------------------------------------------------- |
| `workspace` | `read`, `create` |
| `role` | `read`, `create`, `edit`, `delete` |
| `member` | `read`, `create`, `edit`, `delete` |
| `secret-scanning` | `read`, `create`, `edit`, `delete` |
| `settings` | `read`, `create`, `edit`, `delete` |
| `incident-account` | `read`, `create`, `edit`, `delete` |
| `sso` | `read`, `create`, `edit`, `delete` |
| `scim` | `read`, `create`, `edit`, `delete` |
| `ldap` | `read`, `create`, `edit`, `delete` |
| `groups` | `read`, `create`, `edit`, `delete`, `manage-privileges`, `add-members`, `remove-members` |
| `billing` | `read`, `create`, `edit`, `delete` |
| `identity` | `read`, `create`, `edit`, `delete`, `manage-privileges`, `revoke-auth`, `create-token`, `delete-token`, `get-token` |
| `project-templates` | `read`, `create`, `edit`, `delete` |
| `app-connections` | `read`, `create`, `edit`, `delete`, `connect` |
| `kms` | `read` |
</Tab>
</Tabs>
## Inversion
Permission inversion allows you to explicitly deny actions instead of allowing them. This is supported for the following subjects:
- secrets
- secret-folders
- secret-imports
- dynamic-secrets
When a permission is inverted, it changes from an "allow" rule to a "deny" rule. For example:
```typescript
// Regular permission - allows reading secrets
{
subject: "secrets",
action: ["read"]
}
// Inverted permission - denies reading secrets
{
subject: "secrets",
action: ["read"],
inverted: true
}
```
## Conditions
Conditions allow you to create more granular permissions by specifying criteria that must be met for the permission to apply. This is supported for the following subjects:
- secrets
- secret-folders
- secret-imports
- dynamic-secrets
### Properties
Conditions can be applied to the following properties:
- `environment`: Control access based on environment slugs
- `secretPath`: Control access based on secret paths
- `secretName`: Control access based on secret names
- `secretTags`: Control access based on tags (only supports $in operator)
### Operators
The following operators are available for conditions:
| Operator | Description | Example |
| -------- | ---------------------------------- | ----------------------------------------------------- |
| `$eq` | Equal | `{ environment: { $eq: "production" } }` |
| `$ne` | Not equal | `{ environment: { $ne: "development" } }` |
| `$in` | Matches any value in array | `{ environment: { $in: ["staging", "production"] } }` |
| `$glob` | Pattern matching using glob syntax | `{ secretPath: { $glob: "/app/\*" } }` |
These details are especially useful if you're using the API to [create new project roles](../api-reference/endpoints/project-roles/create).
The rules outlined on this page, also apply when using our Terraform Provider to manage your Infisical project roles, or any other of our clients that manage project roles.
## Migrating from permission V1 to permission V2
When upgrading to V2 permissions (i.e. when moving from using the `permissions` to `permissions_v2` field in your Terraform configurations, or upgrading to the V2 permission API), you'll need to update your permission structure as follows:
Any permissions for `secrets` should be expanded to include equivalent permissions for:
- `secret-imports`
- `secret-folders` (except for read permissions)
- `dynamic-secrets`
For dynamic secrets, the actions need to be mapped differently:
- `read` → `read-root-credential`
- `create` → `create-root-credential`
- `edit` → `edit-root-credential` (also adds `lease` permission)
- `delete` → `delete-root-credential`
Example:
```hcl
# Old V1 configuration
resource "infisical_project_role" "example" {
name = "example"
permissions = [
{
subject = "secrets"
action = "read"
},
{
subject = "secrets"
action = "edit"
}
]
}
# New V2 configuration
resource "infisical_project_role" "example" {
name = "example"
permissions_v2 = [
# Original secrets permission
{
subject = "secrets"
action = ["read", "edit"]
inverted = false
},
# Add equivalent secret-imports permission
{
subject = "secret-imports"
action = ["read", "edit"]
inverted = false
},
# Add secret-folders permission (without read)
{
subject = "secret-folders"
action = ["edit"]
inverted = false
},
# Add dynamic-secrets permission with mapped actions
{
subject = "dynamic-secrets"
action = ["read-root-credential", "edit-root-credential", "lease"]
inverted = false
}
]
}
```
Note: When moving to V2 permissions, make sure to include all the necessary expanded permissions based on your original `secrets` permissions.

219
docs/internals/permissions/organization-permissions.mdx Normal file
View File

@@ -0,0 +1,219 @@
---
title: "Organization Permissions"
description: "Comprehensive guide to Infisical's organization-level permissions"
---
## Overview
Infisical's organization permissions system follows a role-based access control (RBAC) model built on a subject-action-object framework. At the organization level, these permissions determine what actions users can perform on various resources across the entire organization.
Each permission consists of:
- **Subject**: The resource the permission applies to (e.g., workspaces, members, billing)
- **Action**: The operation that can be performed (e.g., read, create, edit, delete)
Some organization-level resources—specifically `app-connections`—support conditional permissions and permission inversion for more granular access control.
## Available Organization Permissions
Below is a comprehensive list of all available organization-level subjects and their supported actions, organized by functional area.
### Workspace Management
#### Subject: `workspace`
| Action | Description |
| -------- | --------------------- |
| `create` | Create new workspaces |
### Role Management
#### Subject: `role`
| Action | Description |
| -------- | ------------------------------------------------------ |
| `read` | View organization roles and their assigned permissions |
| `create` | Create new organization roles |
| `edit` | Modify existing organization roles |
| `delete` | Remove organization roles |
### User Management
#### Subject: `member`
| Action | Description |
| -------- | ------------------------------------ |
| `read` | View organization members |
| `create` | Add new members to the organization |
| `edit` | Modify member details |
| `delete` | Remove members from the organization |
#### Subject: `groups`
| Action | Description |
| ------------------- | ------------------------------------------------ |
| `read` | View organization groups |
| `create` | Create new groups in the organization |
| `edit` | Modify existing groups |
| `delete` | Remove groups from the organization |
| `manage-privileges` | Change permission levels for organization groups |
| `add-members` | Add members to groups |
| `remove-members` | Remove members from groups |
#### Subject: `identity`
| Action | Description |
| ------------------- | --------------------------------------------------- |
| `read` | View organization identities |
| `create` | Add new identities to organization |
| `edit` | Modify organization identities |
| `delete` | Remove identities from organization |
| `manage-privileges` | Change permission levels of organization identities |
| `revoke-auth` | Revoke authentication for identities |
| `create-token` | Create new authentication tokens |
| `delete-token` | Delete authentication tokens |
| `get-token` | Retrieve authentication tokens |
### Security & Compliance
#### Subject: `secret-scanning`
| Action | Description |
| -------- | ----------------------------------------- |
| `read` | View secret scanning results and settings |
| `create` | Configure secret scanning |
| `edit` | Modify secret scanning settings |
| `delete` | Remove secret scanning configuration |
#### Subject: `settings`
| Action | Description |
| -------- | ----------------------------------------- |
| `read` | View organization settings |
| `create` | Setup and configure organization settings |
| `edit` | Modify organization settings |
| `delete` | Remove organization settings |
#### Subject: `incident-contact`
| Action | Description |
| -------- | -------------------------------- |
| `read` | View incident contacts |
| `create` | Set up new incident contacts |
| `edit` | Modify incident contact settings |
| `delete` | Remove incident contacts |
#### Subject: `audit-logs`
| Action | Description |
| ------ | ---------------------------- |
| `read` | View organization audit logs |
### Identity Provider Integration
#### Subject: `sso`
| Action | Description |
| -------- | ---------------------------------- |
| `read` | View Single Sign-On configurations |
| `create` | Set up new SSO integrations |
| `edit` | Modify existing SSO settings |
| `delete` | Remove SSO configurations |
#### Subject: `scim`
| Action | Description |
| -------- | ----------------------------- |
| `read` | View SCIM configurations |
| `create` | Set up new SCIM provisioning |
| `edit` | Modify existing SCIM settings |
| `delete` | Remove SCIM configurations |
#### Subject: `ldap`
| Action | Description |
| -------- | ----------------------------- |
| `read` | View LDAP configurations |
| `create` | Set up new LDAP integrations |
| `edit` | Modify existing LDAP settings |
| `delete` | Remove LDAP configurations |
### Billing & Subscriptions
#### Subject: `billing`
| Action | Description |
| -------- | ------------------------------------------------ |
| `read` | View billing information and subscription status |
| `create` | Set up new payment methods or subscriptions |
| `edit` | Modify billing details or subscription plans |
| `delete` | Remove payment methods or cancel subscriptions |
### Templates & Automation
#### Subject: `project-templates`
| Action | Description |
| -------- | --------------------------------- |
| `read` | View project templates |
| `create` | Create new project templates |
| `edit` | Modify existing project templates |
| `delete` | Remove project templates |
### Integrations
#### Subject: `app-connections`
Supports conditions and permission inversion
| Action | Description |
| --------- | ---------------------------------- |
| `read` | View app connection configurations |
| `create` | Create new app connections |
| `edit` | Modify existing app connections |
| `delete` | Remove app connections |
| `connect` | Use app connections |
### Key Management
#### Subject: `kms`
| Action | Description |
| -------- | ------------------------------------ |
| `read` | View organization KMS configurations |
| `create` | Set up new KMS configurations |
| `edit` | Modify KMS settings |
| `delete` | Remove KMS configurations |
#### Subject: `kmip`
| Action | Description |
| ------- | ---------------------------------- |
| `setup` | Configure KMIP server settings |
| `proxy` | Act as a proxy for KMIP operations |
### Admin Tools
#### Subject: `organization-admin-console`
| Action | Description |
| --------------------- | ------------------------------------------- |
| `access-all-projects` | Access all projects within the organization |
### Secure Share
#### Subject: `secret-share`
| Action | Description |
| ----------------- | ---------------------------- |
| `manage-settings` | Manage secret share settings |
### Gateway Management
#### Subject: `gateway`
| Action | Description |
| ----------------- | --------------------------------- |
| `list-gateways` | View all organization gateways |
| `create-gateways` | Add new gateways to organization |
| `edit-gateways` | Modify existing gateway settings |
| `delete-gateways` | Remove gateways from organization |

152
docs/internals/permissions/overview.mdx Normal file
View File

@@ -0,0 +1,152 @@
---
title: "Overview"
description: "Infisical's permissions system provides granular access control."
---
## Overview
The Infisical permissions system is based on a role-based access control (RBAC) model. The system allows you to define roles and assign them to users and machines. Each role has a set of permissions that define what actions a user can perform.
Permissions are built on a subject-action-object model. The subject is the resource the permission is being applied to, the action is what the permission allows.
An example of a subject/action combination would be `secrets/read`. This permission allows the subject to read secrets.
## Subjects and Actions
### Project Permissions
Project permissions control access to resources within a specific project, including secrets management, PKI, KMS, and SSH certificate functionality.
For a comprehensive list of all project-level subjects, actions, and detailed descriptions, please refer to the [Project Permissions](/internals/permissions/project-permissions) documentation.
### Organization Permissions
Organization permissions control access to organization-wide resources and settings such as workspaces, billing, identity providers, and more.
For a comprehensive list of all organization-level subjects, actions, and detailed descriptions, please refer to the [Organization Permissions](/internals/permissions/organization-permissions) documentation.
## Inversion
Permission inversion allows you to explicitly deny actions instead of allowing them. This is supported for the following subjects:
- secrets
- secret-folders
- secret-imports
- dynamic-secrets
When a permission is inverted, it changes from an "allow" rule to a "deny" rule. For example:
```typescript
// Regular permission - allows reading secrets
{
subject: "secrets",
action: ["read"]
}
// Inverted permission - denies reading secrets
{
subject: "secrets",
action: ["read"],
inverted: true
}
```
## Conditions
Conditions allow you to create more granular permissions by specifying criteria that must be met for the permission to apply. This is supported for the following subjects:
- secrets
- secret-folders
- secret-imports
- dynamic-secrets
### Properties
Conditions can be applied to the following properties:
- `environment`: Control access based on environment slugs
- `secretPath`: Control access based on secret paths
- `secretName`: Control access based on secret names
- `secretTags`: Control access based on tags (only supports $in operator)
### Operators
The following operators are available for conditions:
| Operator | Description | Example |
| -------- | ---------------------------------- | ----------------------------------------------------- |
| `$eq` | Equal | `{ environment: { $eq: "production" } }` |
| `$ne` | Not equal | `{ environment: { $ne: "development" } }` |
| `$in` | Matches any value in array | `{ environment: { $in: ["staging", "production"] } }` |
| `$glob` | Pattern matching using glob syntax | `{ secretPath: { $glob: "/app/\*" } }` |
These details are especially useful if you're using the API to [create new project roles](../api-reference/endpoints/project-roles/create).
The rules outlined on this page, also apply when using our Terraform Provider to manage your Infisical project roles, or any other of our clients that manage project roles.
## Migrating from permission V1 to permission V2
When upgrading to V2 permissions (i.e. when moving from using the `permissions` to `permissions_v2` field in your Terraform configurations, or upgrading to the V2 permission API), you'll need to update your permission structure as follows:
Any permissions for `secrets` should be expanded to include equivalent permissions for:
- `secret-imports`
- `secret-folders` (except for read permissions)
- `dynamic-secrets`
For dynamic secrets, the actions need to be mapped differently:
- `read` → `read-root-credential`
- `create` → `create-root-credential`
- `edit` → `edit-root-credential` (also adds `lease` permission)
- `delete` → `delete-root-credential`
Example:
```hcl
# Old V1 configuration
resource "infisical_project_role" "example" {
name = "example"
permissions = [
{
subject = "secrets"
action = "read"
},
{
subject = "secrets"
action = "edit"
}
]
}
# New V2 configuration
resource "infisical_project_role" "example" {
name = "example"
permissions_v2 = [
# Original secrets permission
{
subject = "secrets"
action = ["read", "edit"]
inverted = false
},
# Add equivalent secret-imports permission
{
subject = "secret-imports"
action = ["read", "edit"]
inverted = false
},
# Add secret-folders permission (without read)
{
subject = "secret-folders"
action = ["edit"]
inverted = false
},
# Add dynamic-secrets permission with mapped actions
{
subject = "dynamic-secrets"
action = ["read-root-credential", "edit-root-credential", "lease"]
inverted = false
}
]
}
```
Note: When moving to V2 permissions, make sure to include all the necessary expanded permissions based on your original `secrets` permissions.

279
docs/internals/permissions/project-permissions.mdx Normal file
View File

@@ -0,0 +1,279 @@
---
title: "Project Permissions"
description: "Comprehensive guide to Infisical's project-level permissions"
---
## Overview
Infisical's project permissions system follows a role-based access control (RBAC) model built on a subject-action-object framework. At the project level, these permissions determine what actions users can perform on various resources within a specific project.
Each permission consists of:
- **Subject**: The resource the permission applies to (e.g., secrets, members, settings)
- **Action**: The operation that can be performed (e.g., read, create, edit, delete)
Some project-level resources—specifically `secrets`, `secret-folders`, `secret-imports`, and `dynamic-secrets`—support conditional permissions and permission inversion for more granular access control. Conditions allow you to specify criteria (like environment, secret path, or tags) that must be met for the permission to apply.
## Available Project Permissions
Below is a comprehensive list of all available project-level subjects and their supported actions, organized by product line.
### Core Platform & Access Control
#### Subject: `role`
| Action | Description |
| -------- | ------------------------------------------------- |
| `read` | View project roles and their assigned permissions |
| `create` | Create new project roles |
| `edit` | Modify existing project roles |
| `delete` | Remove project roles |
#### Subject: `member`
| Action | Description |
| ------------------- | ------------------------------------------- |
| `read` | View project members |
| `create` | Add new members to the project |
| `edit` | Modify member details |
| `delete` | Remove members from the project |
| `manage-privileges` | Change permission levels of project members |
#### Subject: `groups`
| Action | Description |
| ------------------- | ------------------------------------------ |
| `read` | View project groups |
| `create` | Create new groups within the project |
| `edit` | Modify existing groups |
| `delete` | Remove groups from the project |
| `manage-privileges` | Change permission levels of project groups |
#### Subject: `identity`
| Action | Description |
| ------------------- | ---------------------------------------------- |
| `read` | View project identities |
| `create` | Add new identities to project |
| `edit` | Modify project identities |
| `delete` | Remove identities from project |
| `manage-privileges` | Change permission levels of project identities |
#### Subject: `settings`
| Action | Description |
| -------- | -------------------------------------- |
| `read` | View project settings |
| `create` | Add new project configuration settings |
| `edit` | Modify project settings |
| `delete` | Remove project settings |
#### Subject: `environments`
| Action | Description |
| -------- | ------------------------------------ |
| `read` | View project environments |
| `create` | Add new environments to the project |
| `edit` | Modify existing environments |
| `delete` | Remove environments from the project |
#### Subject: `tags`
| Action | Description |
| -------- | ---------------------------------------- |
| `read` | View project tags |
| `create` | Create new tags for organizing resources |
| `edit` | Modify existing tags |
| `delete` | Remove tags from the project |
#### Subject: `workspace`
| Action | Description |
| -------- | ------------------------- |
| `edit` | Modify workspace settings |
| `delete` | Delete the workspace |
#### Subject: `ip-allowlist`
| Action | Description |
| -------- | -------------------------------------------- |
| `read` | View IP allowlists |
| `create` | Add new IP addresses or ranges to allowlists |
| `edit` | Modify existing IP allowlist entries |
| `delete` | Remove IP addresses from allowlists |
#### Subject: `audit-logs`
| Action | Description |
| ------ | ------------------------------------------------------- |
| `read` | View audit logs of actions performed within the project |
#### Subject: `integrations`
| Action | Description |
| -------- | -------------------------------- |
| `read` | View configured integrations |
| `create` | Add new third-party integrations |
| `edit` | Modify integration settings |
| `delete` | Remove integrations |
#### Subject: `webhooks`
| Action | Description |
| -------- | ------------------------------------ |
| `read` | View webhook configurations |
| `create` | Add new webhooks |
| `edit` | Modify webhook endpoints or triggers |
| `delete` | Remove webhooks |
#### Subject: `service-tokens`
| Action | Description |
| -------- | ---------------------------------------- |
| `read` | View service tokens |
| `create` | Create new service tokens for API access |
| `edit` | Modify token properties |
| `delete` | Revoke or remove service tokens |
### Secrets Management
#### Subject: `secrets`
Supports conditions and permission inversion
| Action | Description |
| -------- | ------------------------------- |
| `read` | View secrets and their values |
| `create` | Add new secrets to the project |
| `edit` | Modify existing secret values |
| `delete` | Remove secrets from the project |
#### Subject: `secret-folders`
Supports conditions and permission inversion
| Action | Description |
| -------- | ------------------------ |
| `read` | View secret folders |
| `create` | Create new folders |
| `edit` | Modify folder properties |
| `delete` | Remove secret folders |
#### Subject: `secret-imports`
Supports conditions and permission inversion
| Action | Description |
| -------- | --------------------- |
| `read` | View secret imports |
| `create` | Create secret imports |
| `edit` | Modify secret imports |
| `delete` | Remove secret imports |
#### Subject: `secret-rollback`
| Action | Description |
| -------- | ---------------------------------- |
| `read` | View secret versions and snapshots |
| `create` | Roll back secrets to snapshots |
#### Subject: `secret-approval`
| Action | Description |
| -------- | ----------------------------------- |
| `read` | View approval policies and requests |
| `create` | Create new approval policies |
| `edit` | Modify approval policies |
| `delete` | Remove approval policies |
#### Subject: `secret-rotation`
| Action | Description |
| -------- | ------------------------------------- |
| `read` | View secret rotation policies |
| `create` | Set up automatic secret rotation |
| `edit` | Modify rotation schedules or policies |
| `delete` | Remove rotation policies |
#### Subject: `secret-syncs`
| Action | Description |
| ---------------- | -------------------------------------------------- |
| `read` | View secret synchronization configurations |
| `create` | Create new sync configurations |
| `edit` | Modify existing sync settings |
| `delete` | Remove sync configurations |
| `sync-secrets` | Execute synchronization of secrets between systems |
| `import-secrets` | Import secrets from sync sources |
| `remove-secrets` | Remove secrets from sync destinations |
#### Subject: `dynamic-secrets`
Supports conditions and permission inversion
| Action | Description |
| ------------------------ | ---------------------------------- |
| `read-root-credential` | View dynamic secret configurations |
| `create-root-credential` | Create dynamic secrets |
| `edit-root-credential` | Edit dynamic secrets |
| `delete-root-credential` | Remove dynamic secrets |
| `lease` | Create dynamic secret leases |
### Key Management Service (KMS)
#### Subject: `kms`
| Action | Description |
| ------ | --------------------------- |
| `edit` | Modify project KMS settings |
#### Subject: `cmek`
| Action | Description |
| --------- | ------------------------------------- |
| `read` | View Customer-Managed Encryption Keys |
| `create` | Add new encryption keys |
| `edit` | Modify key properties |
| `delete` | Remove encryption keys |
| `encrypt` | Use keys for encryption operations |
| `decrypt` | Use keys for decryption operations |
### Public Key Infrastructure (PKI)
#### Subject: `certificate-authorities`
| Action | Description |
| -------- | ---------------------------------- |
| `read` | View certificate authorities |
| `create` | Create new certificate authorities |
| `edit` | Modify CA configurations |
| `delete` | Remove certificate authorities |
#### Subject: `certificates`
| Action | Description |
| -------- | ----------------------------- |
| `read` | View certificates |
| `create` | Issue new certificates |
| `delete` | Revoke or remove certificates |
#### Subject: `certificate-templates`
| Action | Description |
| -------- | -------------------------------- |
| `read` | View certificate templates |
| `create` | Create new certificate templates |
| `edit` | Modify template configurations |
| `delete` | Remove certificate templates |
#### Subject: `pki-alerts`
| Action | Description |
| -------- | ------------------------------------------------------------ |
| `read` | View PKI alert configurations |
| `create` | Create new alerts for certificate expiry or other PKI events |
| `edit` | Modify alert settings |
| `delete` | Remove PKI alerts |
#### Subject: `pki-collections`
| Action | Description |
| -------- | --------------------------------------------------- |
| `read` | View PKI resource collections |
| `create` | Create new collections for organizing PKI resources |
| `edit` | Modify collection properties |
| `delete` | Remove PKI collections |
### SSH Certificate Management
#### Subject: `ssh-certificate-authorities`
| Action | Description |
| -------- | -------------------------------------- |
| `read` | View SSH certificate authorities |
| `create` | Create new SSH certificate authorities |
| `edit` | Modify SSH CA configurations |
| `delete` | Remove SSH certificate authorities |
#### Subject: `ssh-certificates`
| Action | Description |
| -------- | --------------------------------- |
| `read` | View SSH certificates |
| `create` | Issue new SSH certificates |
| `edit` | Modify SSH certificate properties |
| `delete` | Revoke or remove SSH certificates |
#### Subject: `ssh-certificate-templates`
| Action | Description |
| -------- | ------------------------------------ |
| `read` | View SSH certificate templates |
| `create` | Create new SSH certificate templates |
| `edit` | Modify SSH template configurations |
| `delete` | Remove SSH certificate templates |

9
docs/mint.json
View File

@@ -1150,7 +1150,14 @@
"group": "Internals",
"pages": [
"internals/overview",
"internals/permissions",
{
"group": "Permissions",
"pages": [
"internals/permissions/overview",
"internals/permissions/project-permissions",
"internals/permissions/organization-permissions"
]
},
"internals/components",
"internals/security",
"internals/service-tokens"