awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added rbac to docs navigation and fixed typos

Browse Source
This commit is contained in:
Vladyslav Matsiiako
2023-11-25 18:32:37 -08:00
parent 7a9221769d
commit d7262d4291
3 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docs/documentation/platform/role-based-access-controls.mdx
View File

@@ -1,8 +1,10 @@
---
title: "Role-based Access Controls"
description: "Infisical's Role-based Acccess Controls enable creating permissions for user and machine identities to restrict the actions that can be undertaken."
description: "Infisical's Role-based Acccess Controls enable creating permissions for user and machine identities to restrict access to resources and the range of actions that can performed."
---
### General access controls
Access Control Policies provide a highly granular declarative way to grant or forbid access to certain resources and operations in Infisical. In general, access controls can be split up across projects and organizations.
### Organization-level access controls
@@ -17,13 +19,13 @@ Overall, organization-level access controls are significantly of administrative
### Project-level access controls
By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles has a varying access to various features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode.
By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode.
### Creating custom roles
By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for:
- Creating superadmin roles, roles specific to SRE engineers, etc.
- Restricting access of users to specific secrets, folders, and environments.
- Enbedding these specific roles into [PR Workflow policies] (https://infisical.com/docs/documentation/platform/pr-workflows)
- Embedding these specific roles into [PR Workflow policies](https://infisical.com/docs/documentation/platform/pr-workflows)
![project member custom role](../../images/platform/rbac/project-member-custom-role.png)