Menu
Enterprise Grafana Cloud

Manage access using roles

In Grafana Enterprise and Grafana Cloud, there are Basic, Fixed, and Custom roles.

Basic roles

There are four basic roles: Admin, Editor, Viewer, and No basic role. Each basic role contains a number of fixed roles.

The No basic role allows you to further customize access by assigning fixed roles to users, which you can also modify. You can also create and assign custom roles to a user with No basic role.

Details of the basic roles and the access they provide for Grafana Alerting are below.

RoleAccess
AdminWrite access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), and provisioning.
EditorWrite access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), and provisioning.
ViewerRead access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences).
No basic roleA blank canvas to assign fixed or custom roles and craft permissions more precisely. For example, if you want to give a user the ability to see alert rules, but not notification settings, add No basic role and then the fixed role Rules reader.

Fixed roles

A fixed role is a group of multiple permissions.

Fixed roles provide users more granular access to create, view, and update Alerting resources than you would have with basic roles alone.

Details of the fixed roles and the access they provide for Grafana Alerting are below.

Display name in UI / Fixed rolePermissionsDescription
Silences Writer: fixed:alerting.instances:writerAll permissions from fixed:alerting.instances:reader and
alert.instances:create
alert.instances:write for organization scope
alert.instances.external:write for scope datasources:*
Add and update silences in Grafana and external providers.
Instances and Silences Reader: fixed:alerting.instances:readeralert.instances:read for organization scope
alert.instances.external:read for scope datasources:*
Read alert instances and silences in Grafana and external providers.
Notifications Writer: fixed:alerting.notifications:writerAll permissions from fixed:alerting.notifications:reader and
alert.notifications:writefor organization scope
alert.notifications.external:read for scope datasources:*
Add, update, and delete notification policies and contact points in Grafana and external providers.
Notifications Reader: fixed:alerting.notifications:readeralert.notifications:read for organization scope
alert.notifications.external:read for scope datasources:*
Read notification policies and contact points in Grafana and external providers.
Rules Writer: fixed:alerting.rules:writerAll permissions from fixed:alerting.rules:reader and
alert.rule:create
alert.rule:write
alert.rule:delete
alert.silences:create
alert.silences:write for scope folders:*
alert.rules.external:write for scope datasources:*
Create, update, and delete all alert rules and manage rule-specific silences.
Rules Reader: fixed:alerting.rules:readeralert.rule:read, alert.silences:read for scope folders:*
alert.rules.external:read for scope datasources:*
alert.notifications.time-intervals:read
alert.notifications.receivers:list
Read all alert rules and rule-specific silences in Grafana and external providers.
Full access: fixed:alerting:writerAll permissions from fixed:alerting.rules:writer
fixed:alerting.instances:writer
fixed:alerting.notifications:writer
Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers.
Full read-only access: fixed:alerting:readerAll permissions from fixed:alerting.rules:reader
fixed:alerting.instances:reader
fixed:alerting.notifications:reader
Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers.
Read via Provisioning API + Export Secrets: fixed:alerting.provisioning.secrets:readeralert.provisioning:read and alert.provisioning.secrets:readRead alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets.
Access to alert rules provisioning API: fixed:alerting.provisioning:writeralert.provisioning:read and alert.provisioning:writeManage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API.
Set provisioning status: fixed:alerting.provisioning.status:writeralert.provisioning.provenance:writeSet provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.)

If you have enabled the alertingApiServer feature toggle, an additional set of fixed roles is available.

Display name in UI / Fixed rolePermissionsDescription
Contact Point Reader: fixed:alerting.receivers:readeralert.notifications.receivers:read for scope receivers:*Read all contact points.
Contact Point Creator: fixed:alerting.receivers:creatoralert.notifications.receivers:createCreate a new contact point. The user is automatically granted full access to the created contact point.
Contact Point Writer: fixed:alerting.receivers:writeralert.notifications.receivers:read, alert.notifications.receivers:write, alert.notifications.receivers:delete for scope receivers:* and
alert.notifications.receivers:create
Create a new contact point and manage all existing contact points.
Templates Reader: fixed:alerting.templates:readeralert.notifications.templates:readRead all notification templates.
Templates Writer: fixed:alerting.templates:writeralert.notifications.templates:read, alert.notifications.templates:write, alert.notifications.templates:deleteCreate new and manage existing notification templates.
Time Intervals Reader: fixed:alerting.time-intervals:readeralert.notifications.time-intervals:readRead all time intervals.
Time Intervals Writer: fixed:alerting.time-intervals:writeralert.notifications.time-intervals:read, alert.notifications.time-intervals:write, alert.notifications.time-intervals:deleteCreate new and manage existing time intervals.

Create custom roles

Create custom roles of your own to manage permissions. Custom roles contain unique combinations of permissions, actions and scopes. Create a custom role when basic roles and fixed roles do not meet your permissions requirements.

For more information on creating custom roles, refer to Create custom roles.

Note

It is not recommended to create custom roles that include alerting.notifications.receiver actions with a scope other than receivers:*. The UID used in the scope is not stable and changes whenever a contact point is renamed.

Examples

The following examples give you an idea of how you can combine permissions for Grafana Alerting.

A custom role for read access to alert rules in folder F:

PUT access-control/roles
{
	"name": "custom:alert_rules_reader",
	"displayName": "Alert rule reader in folder F",
	"description": "Read access to rules in folder F that use DS1 and DS2",
	"permissions": [
    	{
        	"action": "alert.rules:read",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "folders:read",
        	"scope": "folders:uid:UID_F"
    	}
	]
}

A custom role for write access to alert rules that uses simplified routing:

PUT access-control/roles
{
	"name": "custom:alert_rules_updater",
	"displayName": "Alert rules editor in folder F",
	"description": "Edit access to rules in folder F that use DS1 and DS2",
	"permissions": [
    	{
        	"action": "alert.rules:read",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.rules:read",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.rules:write",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.rules:create",
        	"scope": "folders:uid:UID_F"
    	},
    	{
        	"action": "alert.notifications.receivers:list",
    	},
{
        	"action": "alert.notifications.time-intervals:read",
    	},
	]
}

Note

Delete the last two permissions if you aren’t using simplified notification routing.

Assign roles

To assign roles, complete the following steps.

  1. Navigate to Administration > Users and access > Users, Teams, or Service Accounts.
  2. Search for the user, team or service account you want to add a role for.
  3. Select the role you want to assign.