Menu

Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

Grafana Cloud Enterprise

RBAC role definitions

Note: Available in Grafana Enterprise and Grafana Cloud Advanced.

The following tables list permissions associated with basic and fixed roles.

Basic role assignments

Basic roleAssociated fixed rolesDescription
Grafana Adminfixed:roles:reader
fixed:roles:writer
fixed:users:reader
fixed:users:writer
fixed:org.users:reader
fixed:org.users:writer
fixed:ldap:reader
fixed:ldap:writer
fixed:stats:reader
fixed:settings:reader
fixed:settings:writer
fixed:provisioning:writer
fixed:organization:reader
fixed:organization:maintainer
fixed:licensing:reader
fixed:licensing:writer
fixed:datasources.caching:reader
fixed:datasources.caching:writer
fixed:dashboards.insights:reader
fixed:datasources.insights:reader
fixed:plugins:maintainer
Default Grafana server administrator assignments.
Adminfixed:reports:reader
fixed:reports:writer
fixed:datasources:reader
fixed:datasources:writer
fixed:organization:writer
fixed:datasources.permissions:reader
fixed:datasources.permissions:writer
fixed:teams:writer
fixed:dashboards:reader
fixed:dashboards:writer
fixed:dashboards.permissions:reader
fixed:dashboards.permissions:writer
fixed:folders:reader
fixed:folders:writer
fixed:folders.permissions:reader
fixed:folders.permissions:writer
fixed:alerting:writer
fixed:apikeys:reader
fixed:apikeys:writer
fixed:alerting.provisioning:writer
fixed:datasources.caching:reader
fixed:datasources.caching:writer
fixed:dashboards.insights:reader
fixed:datasources.insights:reader
fixed:plugins:writer
Default Grafana organization administrator assignments.
Editorfixed:datasources:explorer
fixed:dashboards:creator
fixed:folders:creator
fixed:annotations:writer
fixed:teams:creator if the editors_can_admin configuration flag is enabled
fixed:alerting:writer
fixed:dashboards.insights:reader
fixed:datasources.insights:reader
Default Editor assignments.
Viewerfixed:datasources:id:reader
fixed:organization:reader
fixed:annotations:reader
fixed:annotations.dashboard:writer
fixed:alerting:reader
fixed:plugins.app:reader
fixed:dashboards.insights:reader
fixed:datasources.insights:reader
Default Viewer assignments.

Fixed role definitions

Fixed rolePermissionsDescription
fixed:alerting.instances:writerAll permissions from fixed:alerting.instances:reader and
alert.instances:create
alert.instances:write for organization scope
alert.instances.external:write for scope datasources:*
Create, update and expire all silences in the organization produced by Grafana, Mimir, and Loki.*
fixed:alerting.instances:readeralert.instances:read for organization scope
alert.instances.external:read for scope datasources:*
Read all alerts and silences in the organization produced by Grafana Alerts and Mimir and Loki alerts and silences.*
fixed:alerting.notifications:writerAll permissions from fixed:alerting.notifications:reader and
alert.notifications:writefor organization scope
alert.notifications.external:read for scope datasources:*
Create, update, and delete contact points, templates, mute timings and notification policies for Grafana and external Alertmanager.*
fixed:alerting.notifications:readeralert.notifications:read for organization scope
alert.notifications.external:read for scope datasources:*
Read all Grafana and Alertmanager contact points, templates, and notification policies.*
fixed:alerting.rules:writerAll permissions from fixed:alerting.rules:reader and
alert.rule:create
alert.rule:write
alert.rule:delete for scope folders:*
alert.rules.external:write for scope datasources:*
Create, update, and delete all* Grafana, Mimir, and Loki alert rules.*
fixed:alerting.rules:readeralert.rule:read for scope folders:*
alert.rules.external:read for scope datasources:*
Read all* Grafana, Mimir, and Loki alert rules.*
fixed:alerting:writerAll permissions from fixed:alerting.rules:writer
fixed:alerting.instances:writer
fixed:alerting.notifications:writer
Create, update, and delete Grafana, Mimir, Loki and Alertmanager alert rules*, silences, contact points, templates, mute timings, and notification policies.*
fixed:alerting:readerAll permissions from fixed:alerting.rules:reader
fixed:alerting.instances:reader
fixed:alerting.notifications:reader
Read-only permissions for all Grafana, Mimir, Loki and Alertmanager alert rules*, alerts, contact points, and notification policies.*
fixed:alerting.provisioning:writeralert.provisioning:read and alert.provisioning:writeCreate, update and delete Grafana alert rules, notification policies, contact points, templates, etc via provisioning API. *
fixed:annotations.dashboard:writerannotations:write
annotations.create
annotations:delete for scope annotations:type:dashboard
Create, update and delete dashboard annotations and annotation tags.
fixed:annotations:readerannotations:read for scopes annotations:type:*Read all annotations and annotation tags.
fixed:annotations:writerAll permissions from fixed:annotations:reader
annotations:write
annotations.create
annotations:delete for scope annotations:type:*
Read, create, update and delete all annotations and annotation tags.
fixed:apikeys:readerapikeys:read for scope apikeys:*Read all api keys.
fixed:apikeys:writerAll permissions from fixed:apikeys:reader and
apikeys:create
apikeys:delete for scope apikeys:*
Read, create, delete all api keys.
fixed:dashboards:creatordashboards:create
folders:read
Create dashboards.
fixed:dashboards.insights:readerdashboards.insights:readRead dashboard insights data and see presence indicators.
fixed:dashboards.permissions:readerdashboards.permissions:readRead all dashboard permissions.
fixed:dashboards.permissions:writerAll permissions from fixed:dashboards.permissions:reader and
dashboards.permissions:write
Read and update all dashboard permissions.
fixed:dashboards:readerdashboards:readRead all dashboards.
fixed:dashboards:writerAll permissions from fixed:dashboards:reader and
dashboards:write
dashboards:edit
dashboards:delete
dashboards:create
dashboards.permissions:read
dashboards.permissions:write
Read, create, update, and delete all dashboards.
fixed:datasources.caching:readerdatasources.caching:readRead data source query caching settings.
fixed:datasources.caching:writerdatasources.caching:read
datasources.caching:write
Enable, disable, or update query caching settings.
fixed:datasources:explorerdatasources:exploreEnable the Explore feature. Data source permissions still apply, you can only query data sources for which you have query permissions.
fixed:datasources:id:readerdatasources.id:readRead the ID of a data source based on its name.
fixed:datasources.insights:readerdatasources.insights:readRead data source insights data.
fixed:datasources.permissions:readerdatasources.permissions:readRead data source permissions.
fixed:datasources.permissions:writerAll permissions from fixed:datasources.permissions:reader and
datasources.permissions:write
Create, read, or delete permissions of a data source.
fixed:datasources:readerdatasources:read
datasources:query
Read and query data sources.
fixed:datasources:writerAll permissions from fixed:datasources:reader and
datasources:create
datasources:write
datasources:delete
Read, query, create, delete, or update a data source.
fixed:folders.permissions:readerfolders.permissions:readRead all folder permissions.
fixed:folders.permissions:writerAll permissions from fixed:folders.permissions:reader and
folders.permissions:write
Read and update all folder permissions.
fixed:folders:creatorfolders:createCreate folders.
fixed:folders:readerfolders:read
dashboards:read
Read all folders and dashboards.
fixed:folders:writerAll permissions from fixed:dashboards:writer and
folders:read
folders:write
folders:create
folders:delete
folders.permissions:read
folders.permissions:write
Read, create, update, and delete all folders and dashboards.
fixed:ldap:readerldap.user:read
ldap.status:read
Read the LDAP configuration and LDAP status information.
fixed:ldap:writerAll permissions from fixed:ldap:reader and
ldap.user:sync
ldap.config:reload
Read and update the LDAP configuration, and read LDAP status information.
fixed:licensing:readerlicensing:read
licensing.reports:read
Read licensing information and licensing reports.
fixed:licensing:writerAll permissions from fixed:licensing:viewer and
licensing:write
licensing:delete
Read licensing information and licensing reports, update and delete the license token.
fixed:org.users:readerorg.users:readRead users within a single organization.
fixed:org.users:writerAll permissions from fixed:org.users:reader and
org.users:add
org.users:remove
org.users:write
Within a single organization, add a user, invite a new user, read information about a user and their role, remove a user from that organization, or change the role of a user.
fixed:organization:maintainerAll permissions from fixed:organization:reader and
orgs:write
orgs:create
orgs:delete
orgs.quotas:write
Create, read, write, or delete an organization. Read or write its quotas. This role needs to be assigned globally.
fixed:organization:readerorgs:read
orgs.quotas:read
Read an organization and its quotas.
fixed:organization:writerAll permissions from fixed:organization:reader and
orgs:write
orgs.preferences:read
orgs.preferences:write
Read an organization, its quotas, or its preferences. Update organization properties, or its preferences.
fixed:plugins.app:readerplugins.app:accessAccess application plugins (still enforcing the organization role).
fixed:plugins:maintainerplugins:installInstall and uninstall plugins.
fixed:plugins:writerplugins:writeEnable and disable plugins and edit plugins’ settings.
fixed:provisioning:writerprovisioning:reloadReload provisioning.
fixed:reports:readerreports:read
reports:send
reports.settings:read
Read all reports and shared report settings.
fixed:reports:writerAll permissions from fixed:reports:reader and
reports:create
reports:write
reports:delete
reports.settings:write
Create, read, update, or delete all reports and shared report settings.
fixed:roles:readerroles:read
teams.roles:read
users.roles:read
users.permissions:read
Read all access control roles, roles and permissions assigned to users, teams.
fixed:roles:writerAll permissions from fixed:roles:reader and
roles:write
roles:delete
teams.roles:add
teams.roles:remove
users.roles:add
users.roles:remove
Create, read, update, or delete all roles, assign or unassign roles to users, teams.
fixed:roles:resetterroles:write with scope permissions:type:escalateReset basic roles to their default.
fixed:serviceaccounts:readerserviceaccounts:readRead Grafana service accounts.
fixed:serviceaccounts:creatorserviceaccounts:createCreate Grafana service accounts.
fixed:serviceaccounts:writerserviceaccounts:read
serviceaccounts:create
serviceaccounts:write
serviceaccounts:delete
serviceaccounts.permissions:read
serviceaccounts.permissions:write
Create, update, read and delete all Grafana service accounts and manage service account permissions.
fixed:settings:readersettings:readRead Grafana instance settings.
fixed:settings:writerAll permissions from fixed:settings:reader and
settings:write
Read and update Grafana instance settings.
fixed:stats:readerserver.stats:readRead Grafana instance statistics.
fixed:teams:creatorteams:create
org.users:read
Create a team and list organization users (required to manage the created team).
fixed:teams:writerteams:create
teams:delete
teams:read
teams:write
teams.permissions:read
teams.permissions:write
Create, read, update and delete teams and manage team memberships.
fixed:users:readerusers:read
users.quotas:read
users.authtoken:read
`
Read all users and their information, such as team memberships, authentication tokens, and quotas.
fixed:users:writerAll permissions from fixed:users:reader and
users:write
users:create
users:delete
users:enable
users:disable
users.password:write
users.permissions:write
users:logout
users.authtoken:write
users.quotas:write
Read and update all attributes and settings for all users in Grafana: update user information, read user information, create or enable or disable a user, make a user a Grafana administrator, sign out a user, update a user’s authentication token, or update quotas for all users.

Alerting roles

If alerting is enabled, you can use predefined roles to manage user access to alert rules, alert instances, and alert notification settings and create custom roles to limit user access to alert rules in a folder.

Access to Grafana alert rules is an intersection of many permissions:

  • Permission to read a folder. For example, the fixed role fixed:folders:reader includes the action folders:read and a folder scope folders:id:.
  • Permission to query all data sources that a given alert rule uses. If a user cannot query a given data source, they cannot see any alert rules that query that data source.

There is only one exclusion at this moment. Role fixed:alerting.provisioning:writer does not require user to have any additional permissions and provides access to all aspects of the alerting configuration via special provisioning API.

For more information about the permissions required to access alert rules, refer to Create a custom role to access alerts in a folder.

Grafana OnCall roles (beta)

Note: Available from Grafana 9.4 in early access.

Note: This feature is behind the accessControlOnCall feature toggle. You can enable feature toggles through configuration file or environment variables. See configuration docs for details.

If you are using Grafana OnCall, you can try out the integration between Grafana OnCall and RBAC. This will allow you to control access to different OnCall features using the following RBAC roles:

Fixed rolePermissionsDescription
plugins:grafana-oncall-app:readerplugins.app:access
grafana-oncall-app.alert-groups:read
grafana-oncall-app.integrations:read
grafana-oncall-app.escalation-chains:read
grafana-oncall-app.schedules:read
grafana-oncall-app.chatops:read
grafana-oncall-app.outgoing-webhooks:read
grafana-oncall-app.maintenance:read
grafana-oncall-app.notification-settings:read
grafana-oncall-app.user-settings:read
grafana-oncall-app.other-settings:read
Read everything in OnCall.
plugins:grafana-oncall-app:oncallerAll permissions from plugins:grafana-oncall-app:reader and grafana-oncall-app.alert-groups:write
grafana-oncall-app.schedules:write
Read everything in OnCall and edit alert groups and schedules.
plugins:grafana-oncall-app:editorAll permissions from plugins:grafana-oncall-app:oncaller and grafana-oncall-app.notifications:read
grafana-oncall-app.integrations:test
grafana-oncall-app.schedules:export
grafana-oncall-app.chatops:write
grafana-oncall-app.maintenance:write
grafana-oncall-app.notification-settings:write
grafana-oncall-app.user-settings:write
Read everything in OnCall and edit alert groups, schedules, ChatOps, maintenance, notification settings, and user’s own settings.
plugins:grafana-oncall-app:adminAll permissions from plugins:grafana-oncall-app:editor and grafana-oncall-app.integrations:write
grafana-oncall-app.escalation-chains:write
grafana-oncall-app.chatops:update-settings:write
grafana-oncall-app.outgoing-webhooks:write
grafana-oncall-app.api-keys:write
grafana-oncall-app.user-settings:admin
grafana-oncall-app.other-settings:write
Read and edit everything in OnCall.
plugins:grafana-oncall-app:alert-groups-readerplugins.app:access
grafana-oncall-app.alert-groups:read
Read OnCall alert groups.
plugins:grafana-oncall-app:alert-groups-editorplugins.app:access
grafana-oncall-app.alert-groups:read
grafana-oncall-app.alert-groups:write
Create, read, update and delete OnCall alert groups.
plugins:grafana-oncall-app:integrations-readerplugins.app:access
grafana-oncall-app.integrations:read
Read OnCall integrations.
plugins:grafana-oncall-app:integrations-editorplugins.app:access
grafana-oncall-app.integrations:read
grafana-oncall-app.integrations:write
grafana-oncall-app.integrations:test
Create, read, update and delete OnCall integrations.
plugins:grafana-oncall-app:escalation-chains-readerplugins.app:access
grafana-oncall-app.escalation-chains:read
Read OnCall escalation chains.
plugins:grafana-oncall-app:escalation-chains-editorplugins.app:access
grafana-oncall-app.escalation-chains:read
grafana-oncall-app.escalation-chains:write
Create, read, update and delete OnCall escalation chains.
plugins:grafana-oncall-app:schedules-readerplugins.app:access
grafana-oncall-app.schedules:read
Read OnCall schedules.
plugins:grafana-oncall-app:schedules-editorplugins.app:access
grafana-oncall-app.schedules:read
grafana-oncall-app.schedules:write
grafana-oncall-app.schedules:export
Create, read, update and delete OnCall schedules.
plugins:grafana-oncall-app:chatops-readerplugins.app:access
grafana-oncall-app.chatops:read
Read OnCall ChatOps.
plugins:grafana-oncall-app:chatops-editorplugins.app:access
grafana-oncall-app.chatops:read
grafana-oncall-app.chatops:write
grafana-oncall-app.chatops:update-settings
Read and update OnCall ChatOps.
plugins:grafana-oncall-app:outgoing-webhooks-readerplugins.app:access
grafana-oncall-app.outgoing-webhooks:read
Read OnCall outgoing webhooks.
plugins:grafana-oncall-app:outgoing-webhooks-editorplugins.app:access
grafana-oncall-app.outgoing-webhooks:read
grafana-oncall-app.outgoing-webhooks:write
Create, read, update and delete OnCall outgoing webhooks.
plugins:grafana-oncall-app:maintenance-readerplugins.app:access
grafana-oncall-app.maintenance:read
Read OnCall maintenance.
plugins:grafana-oncall-app:maintenance-editorplugins.app:access
grafana-oncall-app.maintenance:read
grafana-oncall-app.maintenance:write
Read and update OnCall maintenance.
plugins:grafana-oncall-app:api-keys-readerplugins.app:access
grafana-oncall-app.api-keys:read
Read OnCall API keys.
plugins:grafana-oncall-app:api-keys-editorplugins.app:access
grafana-oncall-app.api-keys:read
grafana-oncall-app.api-keys:write
Create, read, update and delete OnCall API keys. Also grants access to be able to consume the OnCall API.
plugins:grafana-oncall-app:notification-settings-readerplugins.app:access
grafana-oncall-app.notification-settings:read
Read OnCall notification settings.
plugins:grafana-oncall-app:notification-settings-editorplugins.app:access
grafana-oncall-app.notification-settings:read
grafana-oncall-app.notification-settings:write
Read and update OnCall notification settings.
plugins:grafana-oncall-app:user-settings-readerplugins.app:access
grafana-oncall-app.user-settings:read
Read user’s own OnCall user settings.
plugins:grafana-oncall-app:user-settings-editorplugins.app:access
grafana-oncall-app.user-settings:read
grafana-oncall-app.user-settings:write
Read and update user’s own OnCall user settings.
plugins:grafana-oncall-app:user-settings-adminplugins.app:access
grafana-oncall-app.user-settings:read
grafana-oncall-app.user-settings:write
grafana-oncall-app.user-settings:admin
Read and update OnCall user settings for all users.
plugins:grafana-oncall-app:settings-readerplugins.app:access
grafana-oncall-app.other-settings:read
Read OnCall settings.
plugins:grafana-oncall-app:settings-editorplugins.app:access
grafana-oncall-app.other-settings:read
grafana-oncall-app.other-settings:write
Read and update OnCall settings.

The following table lists the default RBAC OnCall role assignments to the basic roles:

Basic roleAssociated fixed rolesDescription
Grafana Adminplugins:grafana-oncall-app:adminDefault Grafana server administrator assignments.
Adminplugins:grafana-oncall-app:adminDefault Grafana organization administrator assignments.
Editorplugins:grafana-oncall-app:editorDefault Editor assignments.
Viewerplugins:grafana-oncall-app:readerDefault Viewer assignments.