DocsICP FilingConsole
Documentation
Home Page Alibaba Cloud DevOps User Guide Application Delivery Global settings Roles and permissions

Roles and permissions

Updated at:
Copy as MD
Product
My Favorites

AppStack uses a role-based access control (RBAC) system to provide fine-grained permission management for resources, applications, and environments.

The AppStack permission system has two levels: organization role permissions and application role permissions.

Organization role permissions

AppStack organization members are classified into four roles: owner, administrator, member, and external member. The organization creator is the owner by default, and member is the default role. You can add members or modify their roles in Organization member management. (AppStack does not currently support custom roles.)

You can assign permissions to roles to enforce fine-grained access control over resources, applications, and other objects in AppStack. The following table lists the default permissions for each role, which can be customized to meet your needs.

(Y: Permission granted; N: Permission denied)

Category

Permission

Owner

Administrator

Member

External member

Application management

Create application

Y

Y

Y

Y

View application

Y

Y

Y

N

Manage application

Y

Y

N

N

Resource management

Import resource

Y

Y

Y

Y

View resource

Y

Y

Y

N

Manage resource

Y

Y

N

N

Global settings

Create application orchestration template

Y

Y

Y

Y

View application orchestration template

Y

Y

Y

Y

Manage application orchestration template

Y

Y

N

N

View organization role permissions

Y

Y

Y

Y

Manage organization role permissions

Y

Y

N

N

View application role permissions

Y

Y

Y

Y

Manage application role permissions

Y

Y

N

N

Create service connection

Y

Y

Y

Y

View all service connections

Y

Y

Y

Y

Manage all service connections

Y

Y

N

N

Modify organization role permissions

To modify permissions for a role, select or deselect the permissions and then click Save. The owner role has all permissions by default and cannot be modified.

Restore default organization role permissions

Click Restore Defaults to reset a role's permissions to their defaults. The default configuration is shown in the table above.

Set organization member roles

You can manage organization member roles centrally in the Alibaba Cloud DevOps organization admin console. For more information, see Organization member management.

Application role permissions

AppStack application members can have one of five roles: owner, maintainer, developer (default), tester, and ops.

By assigning permissions to different roles, you can enforce fine-grained access control over application releases, environments, and other objects in AppStack. The following table shows the default permissions for each role, which you can adjust to meet your requirements.

(Y: Permission granted; N: Permission denied)

Category

Permission

Owner

Maintainer

Developer

Tester

Ops

Application settings

Basic settings

Y

Y

N

N

N

Member settings

(including adding members, modifying member roles, and deleting members)

Y

Y

N

N

N

Delete application

Y

Y

N

N

N

Release

Create/manage pipeline

Controlled by pipeline member permissions

Associate/remove pipeline

Y

Y

Y

Y

Y

Environment

Create environment

Y

Y

Y

Y

Y

Deploy to environment

Y

All environments

Y

All environments

Y

Development environments

Y

Test environments

Y

All environments

Roll back environment

Y

All environments

Y

All environments

Y

Development environments

Y

Test environments

Y

All environments

Scale environment

Y

All environments

Y

All environments

Y

Development environments

Y

Test environments

Y

All environments

Lock/unlock environment

Y

All environments

Y

All environments

Y

Development environments

Y

Test environments

Y

All environments

Configure environment

(including basic environment settings and deployment settings)

Y

All environments

Y

All environments

Y

Development environments

Y

Test environments

Y

All environments

Delete environment

Y

All environments

Y

All environments

Y

Development environments

Y

Test environments

Y

All environments

Orchestration

Create application orchestration

Y

Y

Y

N

Y

Edit application orchestration

Y

Y

Y

N

Y

Export application orchestration

Y

Y

Y

Y

Y

Variables

Create variable group

Y

Y

Y

Y

Y

Manage variable group

(including editing, copying, importing, exporting, configuring, and deleting variable groups)

Y

Y

Y

Y

Y

Modify application role permissions

To modify permissions for a role, select or deselect the permissions and then click Save. The owner role has all permissions by default and cannot be modified.

Restore default application role permissions

Click Restore Defaults to reset a role's permissions to the defaults shown in the table above.

Set application member roles

Go to the target application and navigate to Settings > Member management. On this page, you can add members, modify their roles, and more. For more information, see Member management.

Previous：Template managementNext：Service connections