1. Docs
  2. Administration
  3. Access & Identity
  4. Role-Based Access Control (RBAC)
  5. Permission sets

Permission sets

    Permission sets in Pulumi Cloud are predefined bundles of scopes that are commonly used together. They provide a convenient way to grant related access rights to an entity (resource) or set of entities (resources).

    Entities

    An entity is a Pulumi object that can have permission sets granted on it.

    In Pulumi Cloud’s authorization model, we use the term “entity” instead of “resource” to refer to such objects. This is because “resource” already has a specific meaning within Pulumi (referring to cloud infrastructure resources). We use the term “entity” to avoid confusion when discussing authorization.

    Entity types

    An entity type is a category of resources that can be protected by the RBAC system. In Pulumi Cloud, entity types include stacks, environments, insights accounts, and organization settings. Each entity type has its own set of associated permission sets and can be managed independently through the RBAC system.

    When creating a permission set, it must be of a specific entity type, and only include scopes that are also of that entity type.

    There are four qualified entity types in Pulumi, these are:

    • Stacks: For all operations that affect stacks. Includes:
      • Stack updates
      • Stack configurations
      • Deployment settings
      • Stack tags and annotations
      • Stack webhooks
      • Stack schedules
    • Environments: For all operations that affect environments. Includes:
      • Environment configurations
      • Environment secrets
      • Environment schedules
      • Environment webhooks
      • Environment versions
    • Insights accounts: For all operations that affect insights accounts. Includes:
      • Insights accounts
      • Policy evaluations
      • Scan configurations
      • Results and reports
    • Organization settings: For scopes and permission sets that operate at the org level, like billing settings or managing third-party integrations. Includes:
      • Organization settings
      • Member management
      • Billing and usage
      • Audit logs
      • Integration configurations

    Default permission sets

    Pulumi Cloud provides several default permission sets that you can use to quickly get started:

    Stack permission sets

    Permission setDescriptionIncluded Scopes
    Stack ReadBasic read-only access to stacks. Allows for running previews.stack:read, stack:export, stack:encrypt, stack:decrypt, stack_deployment:read, stack_deployment_settings:read, stack_access:read, stack_annotations:read, stack_schedule:read
    Stack WriteAbility to update stack configurations and run stack updates.Stack Read, + stack:import, stack:cancel_update, stack:write, stack_deployment_settings:write, stack_deployment_settings:encrypt, stack_deployment_cache:read, stack_tags:update, stack_annotations:update, stack_schedule:update, stack_schedule:create, stack_schedule:pause, stack_schedule:resume, stack_schedule:delete, stack_deployment:create, stack_webhook:create, stack_webhook:update, stack_webhook:delete, stack_webhook:read
    Stack AdminGrants full control over stack operations.Stack Write, + stack:delete, stack_access:update, stack:transfer, stack:rename

    Environment permission sets

    Permission setDescriptionIncluded Scopes
    Environment ReadBasic read-only access to environmentsenvironment:read, environment:rotate_history, environment_version:read, environment_schedule:read, environment_tag:read
    Environment OpenAbility to read the environment and access environment secretsEnvironment Read, + environment:open, environment:clone, environment:read_decrypt, environment_version:read_decrypt, environment_version:open
    Environment WriteAbility to modify environment settingsEnvironment Open, + environment:write, environment:rotate, environment_version:create, environment_version:update, environment_version:delete, environment_version:retract, environment_tag:create, environment_tag:update, environment_tag:delete, environment_schedule:create, environment_schedule:update, environment_schedule:pause, environment_schedule:resume, environment_schedule:delete, environment_webhook:read, environment_webhook:create, environment_webhook:update, environment_webhook:delete
    Environment AdminFull control over environment operationsEnvironment Write, + environment:delete

    Insights account permission sets

    Permission setDescriptionIncluded Scopes
    Account ReadBasic read-only access to insights accountsinsights_account:read, insights_account_scan:read, insights_account_access:read
    Account WriteAbility to modify insights accountsAccount Read, + insights_account:update_policy_results, insights_account:update, insights_account:scan, insights_account_scan:update, insights_account_scan:cancel, insights_account_scan:pause, insights_account_scan:resume
    Account AdminFull control over insights accountsAccount Write, + insights_account:delete, insights_account_access:update

    Custom permission sets

    Custom permission sets are only available to organizations using Pulumi Enterprise Edition and Pulumi Business Critical Edition. To learn more about editions visit the pricing page.

    Creating custom permission sets

    To create a custom permission set, you must be an organization admin.

    Visit Settings > Access Management and select the Permission sets tab.

    View all organization permission sets.

    To create a new permission set, click Create custom permission set within the associated entity group.

    You will need to provide a unique name for the permission set. Optionally, but recommended, you can provide a description to contextualize the permission set and its purpose.

    Create a permission set side panel.

    You can then select the scopes you would like to bundle within this permission set.

    Providing a name and description for the permission set.

    Once you’ve selected the preferred scopes, click Create permission set. The panel will close and you should see your new permission set on the permission sets page.

    Your new permission set is visible on the permission sets page.

    You can now assign this custom permission set to roles within your organization.