Policies and Permissions
You manage access in VECTR by creating policies and attaching them to identities (users or groups). A policy is an object that, when associated with an identity or resource, defines their permissions. SRA Auth evaluates these policies when a user makes a request. Permissions in the policies determine whether the request is allowed or denied.
- Identity-based policies. Attach managed policies to IAM identities (users or groups). Identity-based policies grant permissions to an identity.
- Resource-based policies. These are policies that grant permission to a resource.
Identity-based policies are permissions policy documents that control what actions an identity (users or group) can perform, on which resources, and under what conditions.
Currently, resource-based policies affect all users. In a future release, resource-based policies will support the ability to configure principals (users) that have access to these resources.
All policies are either managed by SRA or the customer (end-user):
SRA managed policies. Policies that are created and managed by SRA. These policies cannot be modified or removed by the customer.
Customer managed policies. Policies that you create and manage in your account.
Policies and the Default Root User¶
The default root user is not affected by any policies. By default, the root user belongs to the BasicAccess and Admins group, however their permission is not affected by the policies belonging to these groups. You can even remove the root user from these groups, or delete these groups and the root user will still have full access to VECTR.
Default SRA Managed Policies¶
The following default policies are provided by SRA. Some policies are application-specific. SRA Managed policies cannot be deleted or modified.
|Provides full access to all resources and IAM permissions.
|Provides the ability for a user to read application configurations.
|Provides full access to IAM related resources and permissions, including managing users, groups, and policies.
|Provides the ability for users to stay logged into the application by automatically updating their JWT before it expires. Users who do not have this permission will be time-boxed to the application for 30 minutes.
|Provides the ability for a user to edit their own information, such as name and password.
Default VECTR Policies¶
The following are VECTR specific default policies:
|Provides the ability to perform read and write (including update and delete) operations on all test environments.
|Provides access to perform read operations on all test environments.
|Provides full access (read/write/update/delete) to any non-test environment related endpoints.
|Provides read-only access to any non-test environment related endpoint.
|Provides the ability for a user to manage (list, edit, backup, restore) the environments which they have access to.
|Provides the ability to manage (list, create, edit, delete, backup, restore) all environments.
|Provides read and write access to the Library.
|Provides read-only access to the Library.
|Allows a user to list the environments they can access.
|Provides the ability to interact with VECTR product tours
|Provides read/write access to the "Intro to VECTR Walkthrough" tour environment.
|Allows a user to rename an environment that they have access to.
|Provides the ability for a user to manage (view, edit) tags. This policy is required in order for a user to work with tags, including tagging Assesssment data.
These policies on their own do not provide read or write access to any environments. Instead, they simply give the provided permissions on environments which a user already has access to. These policies must be combined with a DB access policy such as AllDatabaseFullAccess, AllDatabaseReadOnly, or a custom DB policy that you created. ↩↩↩↩