Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Docs
  2. Pulumi Cloud
  3. Identity & access management
  4. Role-Based Access Control (RBAC)
  5. RBAC Scopes

RBAC Scopes

    This document defines all the available scopes in Pulumi Cloud assignable to specific stacks or sets of stacks.

    Note that creating, listing, or restoring stacks are organization-level operations, and these scopes can be found in the organization settings scopes.

    Stacks

    ValueDescription
    stack:cancel_updateCancel an ongoing stack update operation. This halts the current deployment or update process.

    Granted by default permission: Stack Write
    stack:decryptDecrypt sensitive stack data. This allows viewing encrypted configuration values and secrets.

    Granted by default permission: Stack Read
    stack:deleteDelete a stack and its associated resources. This permanently removes the stack from the organization.

    Granted by default permission: Stack Admin
    stack:encryptEncrypt stack data. This secures sensitive information within the stack.

    Granted by default permission: Stack Read
    stack:exportExport stack data and configurations. This allows creating backups or migrating stacks.

    Granted by default permission: Stack Read
    stack:importImport resources into a stack. This allows bringing external resources under management.

    Granted by default permission: Stack Write
    stack:readView stack configurations and settings. This provides read-only access to stack details and parameters.

    Granted by default permission: Stack Read
    stack:renameChange the name of a stack. This updates the stack’s display name across the platform.

    Granted by default permission: Stack Admin
    stack:transferTransfer ownership of a stack to another organization or user. This is used for organizational restructuring or migration.

    Granted by default permission: Stack Admin
    stack:writeModify stack configurations and settings. This allows updating stack parameters and resource definitions.

    Granted by default permission: Stack Write

    Annotations

    ValueDescription
    stack_annotations:readView annotations attached to a stack. This provides context and metadata for stack resources.

    Granted by default permission: Stack Read
    stack_annotations:updateModify or add annotations to a stack. This allows updating stack metadata and documentation.

    Granted by default permission: Stack Write

    Stack Deployments

    ValueDescription
    stack_deployment_cache:readView the deployment cache for a stack. This includes access to cached deployment artifacts and data.

    Granted by default permission: Stack Write
    stack_deployment:createCreate a new deployment for a stack. This initiates the deployment process for infrastructure resources.

    Granted by default permission: Stack Write
    stack_deployment:readView details of stack deployments. This includes access to deployment status and history.

    Granted by default permission: Stack Read
    stack_deployment_settings:encryptEncrypt deployment settings for a stack. This secures sensitive configuration data.

    Granted by default permission: Stack Write
    stack_deployment_settings:readView deployment settings for a stack. This includes access to configuration parameters and metadata.

    Granted by default permission: Stack Read
    stack_deployment_settings:writeModify deployment settings for a stack. This allows updating configuration parameters and metadata.

    Granted by default permission: Stack Write

    Stack Deploy Schedules

    ValueDescription
    stack_schedule:createCreate a new schedule for automated stack deployments. This allows setting up recurring deployment tasks.

    Granted by default permission: Stack Write
    stack_schedule:deleteDelete an existing stack deployment schedule. This permanently removes the scheduled task.

    Granted by default permission: Stack Write
    stack_schedule:pausePause a scheduled stack deployment. This temporarily halts the scheduled deployment process.

    Granted by default permission: Stack Write
    stack_schedule:readView stack deployment schedule configurations. This includes access to schedule details and execution history.

    Granted by default permission: Stack Read
    stack_schedule:resumeResume a paused stack deployment schedule. This restores automated deployment operations.

    Granted by default permission: Stack Write
    stack_schedule:updateModify an existing stack deployment schedule. This allows updating timing, frequency, and other schedule parameters.

    Granted by default permission: Stack Write

    Stack Tags

    ValueDescription
    stack_tags:updateUpdate tags associated with a stack. This helps in organizing and categorizing stack resources.

    Granted by default permission: Stack Write

    Stack Webhooks

    ValueDescription
    stack_webhook:createCreate a new webhook for stack events. This enables integration with external systems for event notifications.

    Granted by default permission: Stack Write
    stack_webhook:deleteDelete an existing stack webhook. This removes the integration and stops event delivery.

    Granted by default permission: Stack Write
    stack_webhook:readView stack webhook configurations. This includes access to webhook endpoints and event triggers.

    Granted by default permission: Stack Write
    stack_webhook:updateModify an existing stack webhook. This allows updating endpoint URLs and event subscriptions.

    Granted by default permission: Stack Write