Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.
RBAC role definitions
Note: Available in Grafana Enterprise and Grafana Cloud Advanced.
The following tables list permissions associated with basic and fixed roles.
Basic role assignments
Basic role | Associated fixed roles | Description |
---|---|---|
Grafana Admin | fixed:roles:reader fixed:roles:writer fixed:users:reader fixed:users:writer fixed:org.users:reader fixed:org.users:writer fixed:ldap:reader fixed:ldap:writer fixed:stats:reader fixed:settings:reader fixed:settings:writer fixed:provisioning:writer fixed:organization:reader fixed:organization:maintainer fixed:licensing:reader fixed:licensing:writer fixed:datasources.caching:reader fixed:datasources.caching:writer fixed:dashboards.insights:reader fixed:datasources.insights:reader fixed:plugins:maintainer | Default Grafana server administrator assignments. |
Admin | fixed:reports:reader fixed:reports:writer fixed:datasources:reader fixed:datasources:writer fixed:organization:writer fixed:datasources.permissions:reader fixed:datasources.permissions:writer fixed:teams:writer fixed:dashboards:reader fixed:dashboards:writer fixed:dashboards.permissions:reader fixed:dashboards.permissions:writer fixed:folders:reader fixed:folders:writer fixed:folders.permissions:reader fixed:folders.permissions:writer fixed:alerting:writer fixed:apikeys:reader fixed:apikeys:writer fixed:alerting.provisioning:writer fixed:datasources.caching:reader fixed:datasources.caching:writer fixed:dashboards.insights:reader fixed:datasources.insights:reader fixed:plugins:writer | Default Grafana organization administrator assignments. |
Editor | fixed:datasources:explorer fixed:dashboards:creator fixed:folders:creator fixed:annotations:writer fixed:teams:creator if the editors_can_admin configuration flag is enabledfixed:alerting:writer fixed:dashboards.insights:reader fixed:datasources.insights:reader | Default Editor assignments. |
Viewer | fixed:datasources:id:reader fixed:organization:reader fixed:annotations:reader fixed:annotations.dashboard:writer fixed:alerting:reader fixed:plugins.app:reader fixed:dashboards.insights:reader fixed:datasources.insights:reader | Default Viewer assignments. |
Fixed role definitions
Fixed role | Permissions | Description |
---|---|---|
fixed:alerting.instances:writer | All permissions from fixed:alerting.instances:reader andalert.instances:create alert.instances:write for organization scopealert.instances.external:write for scope datasources:* | Create, update and expire all silences in the organization produced by Grafana, Mimir, and Loki.* |
fixed:alerting.instances:reader | alert.instances:read for organization scopealert.instances.external:read for scope datasources:* | Read all alerts and silences in the organization produced by Grafana Alerts and Mimir and Loki alerts and silences.* |
fixed:alerting.notifications:writer | All permissions from fixed:alerting.notifications:reader andalert.notifications:write for organization scopealert.notifications.external:read for scope datasources:* | Create, update, and delete contact points, templates, mute timings and notification policies for Grafana and external Alertmanager.* |
fixed:alerting.notifications:reader | alert.notifications:read for organization scopealert.notifications.external:read for scope datasources:* | Read all Grafana and Alertmanager contact points, templates, and notification policies.* |
fixed:alerting.rules:writer | All permissions from fixed:alerting.rules:reader andalert.rule:create alert.rule:write alert.rule:delete for scope folders:* alert.rules.external:write for scope datasources:* | Create, update, and delete all* Grafana, Mimir, and Loki alert rules.* |
fixed:alerting.rules:reader | alert.rule:read for scope folders:* alert.rules.external:read for scope datasources:* | Read all* Grafana, Mimir, and Loki alert rules.* |
fixed:alerting:writer | All permissions from fixed:alerting.rules:writer fixed:alerting.instances:writer fixed:alerting.notifications:writer | Create, update, and delete Grafana, Mimir, Loki and Alertmanager alert rules*, silences, contact points, templates, mute timings, and notification policies.* |
fixed:alerting:reader | All permissions from fixed:alerting.rules:reader fixed:alerting.instances:reader fixed:alerting.notifications:reader | Read-only permissions for all Grafana, Mimir, Loki and Alertmanager alert rules*, alerts, contact points, and notification policies.* |
fixed:alerting.provisioning:writer | alert.provisioning:read and alert.provisioning:write | Create, update and delete Grafana alert rules, notification policies, contact points, templates, etc via provisioning API. * |
fixed:annotations.dashboard:writer | annotations:write annotations.create annotations:delete for scope annotations:type:dashboard | Create, update and delete dashboard annotations and annotation tags. |
fixed:annotations:reader | annotations:read for scopes annotations:type:* | Read all annotations and annotation tags. |
fixed:annotations:writer | All permissions from fixed:annotations:reader annotations:write annotations.create annotations:delete for scope annotations:type:* | Read, create, update and delete all annotations and annotation tags. |
fixed:apikeys:reader | apikeys:read for scope apikeys:* | Read all api keys. |
fixed:apikeys:writer | All permissions from fixed:apikeys:reader andapikeys:create apikeys:delete for scope apikeys:* | Read, create, delete all api keys. |
fixed:dashboards:creator | dashboards:create folders:read | Create dashboards. |
fixed:dashboards.insights:reader | dashboards.insights:read | Read dashboard insights data and see presence indicators. |
fixed:dashboards.permissions:reader | dashboards.permissions:read | Read all dashboard permissions. |
fixed:dashboards.permissions:writer | All permissions from fixed:dashboards.permissions:reader anddashboards.permissions:write | Read and update all dashboard permissions. |
fixed:dashboards:reader | dashboards:read | Read all dashboards. |
fixed:dashboards:writer | All permissions from fixed:dashboards:reader anddashboards:write dashboards:edit dashboards:delete dashboards:create dashboards.permissions:read dashboards.permissions:write | Read, create, update, and delete all dashboards. |
fixed:datasources.caching:reader | datasources.caching:read | Read data source query caching settings. |
fixed:datasources.caching:writer | datasources.caching:read datasources.caching:write | Enable, disable, or update query caching settings. |
fixed:datasources:explorer | datasources:explore | Enable the Explore feature. Data source permissions still apply, you can only query data sources for which you have query permissions. |
fixed:datasources:id:reader | datasources.id:read | Read the ID of a data source based on its name. |
fixed:datasources.insights:reader | datasources.insights:read | Read data source insights data. |
fixed:datasources.permissions:reader | datasources.permissions:read | Read data source permissions. |
fixed:datasources.permissions:writer | All permissions from fixed:datasources.permissions:reader anddatasources.permissions:write | Create, read, or delete permissions of a data source. |
fixed:datasources:reader | datasources:read datasources:query | Read and query data sources. |
fixed:datasources:writer | All permissions from fixed:datasources:reader anddatasources:create datasources:write datasources:delete | Read, query, create, delete, or update a data source. |
fixed:folders.permissions:reader | folders.permissions:read | Read all folder permissions. |
fixed:folders.permissions:writer | All permissions from fixed:folders.permissions:reader andfolders.permissions:write | Read and update all folder permissions. |
fixed:folders:creator | folders:create | Create folders. |
fixed:folders:reader | folders:read dashboards:read | Read all folders and dashboards. |
fixed:folders:writer | All permissions from fixed:dashboards:writer andfolders:read folders:write folders:create folders:delete folders.permissions:read folders.permissions:write | Read, create, update, and delete all folders and dashboards. |
fixed:ldap:reader | ldap.user:read ldap.status:read | Read the LDAP configuration and LDAP status information. |
fixed:ldap:writer | All permissions from fixed:ldap:reader andldap.user:sync ldap.config:reload | Read and update the LDAP configuration, and read LDAP status information. |
fixed:licensing:reader | licensing:read licensing.reports:read | Read licensing information and licensing reports. |
fixed:licensing:writer | All permissions from fixed:licensing:viewer andlicensing:write licensing:delete | Read licensing information and licensing reports, update and delete the license token. |
fixed:org.users:reader | org.users:read | Read users within a single organization. |
fixed:org.users:writer | All permissions from fixed:org.users:reader andorg.users:add org.users:remove org.users:write | Within a single organization, add a user, invite a new user, read information about a user and their role, remove a user from that organization, or change the role of a user. |
fixed:organization:maintainer | All permissions from fixed:organization:reader andorgs:write orgs:create orgs:delete orgs.quotas:write | Create, read, write, or delete an organization. Read or write its quotas. This role needs to be assigned globally. |
fixed:organization:reader | orgs:read orgs.quotas:read | Read an organization and its quotas. |
fixed:organization:writer | All permissions from fixed:organization:reader andorgs:write orgs.preferences:read orgs.preferences:write | Read an organization, its quotas, or its preferences. Update organization properties, or its preferences. |
fixed:plugins.app:reader | plugins.app:access | Access application plugins (still enforcing the organization role). |
fixed:plugins:maintainer | plugins:install | Install and uninstall plugins. |
fixed:plugins:writer | plugins:write | Enable and disable plugins and edit plugins’ settings. |
fixed:provisioning:writer | provisioning:reload | Reload provisioning. |
fixed:reports:reader | reports:read reports:send reports.settings:read | Read all reports and shared report settings. |
fixed:reports:writer | All permissions from fixed:reports:reader andreports:create reports:write reports:delete reports.settings:write | Create, read, update, or delete all reports and shared report settings. |
fixed:roles:reader | roles:read teams.roles:read users.roles:read users.permissions:read | Read all access control roles, roles and permissions assigned to users, teams. |
fixed:roles:writer | All permissions from fixed:roles:reader androles:write roles:delete teams.roles:add teams.roles:remove users.roles:add users.roles:remove | Create, read, update, or delete all roles, assign or unassign roles to users, teams. |
fixed:roles:resetter | roles:write with scope permissions:type:escalate | Reset basic roles to their default. |
fixed:serviceaccounts:reader | serviceaccounts:read | Read Grafana service accounts. |
fixed:serviceaccounts:creator | serviceaccounts:create | Create Grafana service accounts. |
fixed:serviceaccounts:writer | serviceaccounts:read serviceaccounts:create serviceaccounts:write serviceaccounts:delete serviceaccounts.permissions:read serviceaccounts.permissions:write | Create, update, read and delete all Grafana service accounts and manage service account permissions. |
fixed:settings:reader | settings:read | Read Grafana instance settings. |
fixed:settings:writer | All permissions from fixed:settings:reader andsettings:write | Read and update Grafana instance settings. |
fixed:stats:reader | server.stats:read | Read Grafana instance statistics. |
fixed:teams:creator | teams:create org.users:read | Create a team and list organization users (required to manage the created team). |
fixed:teams:writer | teams:create teams:delete teams:read teams:write teams.permissions:read teams.permissions:write | Create, read, update and delete teams and manage team memberships. |
fixed:users:reader | users:read users.quotas:read users.authtoken:read ` | Read all users and their information, such as team memberships, authentication tokens, and quotas. |
fixed:users:writer | All permissions from fixed:users:reader andusers:write users:create users:delete users:enable users:disable users.password:write users.permissions:write users:logout users.authtoken:write users.quotas:write | Read and update all attributes and settings for all users in Grafana: update user information, read user information, create or enable or disable a user, make a user a Grafana administrator, sign out a user, update a user’s authentication token, or update quotas for all users. |
Alerting roles
If alerting is enabled, you can use predefined roles to manage user access to alert rules, alert instances, and alert notification settings and create custom roles to limit user access to alert rules in a folder.
Access to Grafana alert rules is an intersection of many permissions:
- Permission to read a folder. For example, the fixed role
fixed:folders:reader
includes the actionfolders:read
and a folder scopefolders:id:
. - Permission to query all data sources that a given alert rule uses. If a user cannot query a given data source, they cannot see any alert rules that query that data source.
There is only one exclusion at this moment. Role fixed:alerting.provisioning:writer
does not require user to have any additional permissions and provides access to all aspects of the alerting configuration via special provisioning API.
For more information about the permissions required to access alert rules, refer to Create a custom role to access alerts in a folder.
Grafana OnCall roles (beta)
Note: Available from Grafana 9.4 in early access.
Note: This feature is behind the
accessControlOnCall
feature toggle. You can enable feature toggles through configuration file or environment variables. See configuration docs for details.
If you are using Grafana OnCall, you can try out the integration between Grafana OnCall and RBAC. This will allow you to control access to different OnCall features using the following RBAC roles:
Fixed role | Permissions | Description |
---|---|---|
plugins:grafana-oncall-app:reader | plugins.app:access grafana-oncall-app.alert-groups:read grafana-oncall-app.integrations:read grafana-oncall-app.escalation-chains:read grafana-oncall-app.schedules:read grafana-oncall-app.chatops:read grafana-oncall-app.outgoing-webhooks:read grafana-oncall-app.maintenance:read grafana-oncall-app.notification-settings:read grafana-oncall-app.user-settings:read grafana-oncall-app.other-settings:read | Read everything in OnCall. |
plugins:grafana-oncall-app:oncaller | All permissions from plugins:grafana-oncall-app:reader and grafana-oncall-app.alert-groups:write grafana-oncall-app.schedules:write | Read everything in OnCall and edit alert groups and schedules. |
plugins:grafana-oncall-app:editor | All permissions from plugins:grafana-oncall-app:oncaller and grafana-oncall-app.notifications:read grafana-oncall-app.integrations:test grafana-oncall-app.schedules:export grafana-oncall-app.chatops:write grafana-oncall-app.maintenance:write grafana-oncall-app.notification-settings:write grafana-oncall-app.user-settings:write | Read everything in OnCall and edit alert groups, schedules, ChatOps, maintenance, notification settings, and user’s own settings. |
plugins:grafana-oncall-app:admin | All permissions from plugins:grafana-oncall-app:editor and grafana-oncall-app.integrations:write grafana-oncall-app.escalation-chains:write grafana-oncall-app.chatops:update-settings:write grafana-oncall-app.outgoing-webhooks:write grafana-oncall-app.api-keys:write grafana-oncall-app.user-settings:admin grafana-oncall-app.other-settings:write | Read and edit everything in OnCall. |
plugins:grafana-oncall-app:alert-groups-reader | plugins.app:access grafana-oncall-app.alert-groups:read | Read OnCall alert groups. |
plugins:grafana-oncall-app:alert-groups-editor | plugins.app:access grafana-oncall-app.alert-groups:read grafana-oncall-app.alert-groups:write | Create, read, update and delete OnCall alert groups. |
plugins:grafana-oncall-app:integrations-reader | plugins.app:access grafana-oncall-app.integrations:read | Read OnCall integrations. |
plugins:grafana-oncall-app:integrations-editor | plugins.app:access grafana-oncall-app.integrations:read grafana-oncall-app.integrations:write grafana-oncall-app.integrations:test | Create, read, update and delete OnCall integrations. |
plugins:grafana-oncall-app:escalation-chains-reader | plugins.app:access grafana-oncall-app.escalation-chains:read | Read OnCall escalation chains. |
plugins:grafana-oncall-app:escalation-chains-editor | plugins.app:access grafana-oncall-app.escalation-chains:read grafana-oncall-app.escalation-chains:write | Create, read, update and delete OnCall escalation chains. |
plugins:grafana-oncall-app:schedules-reader | plugins.app:access grafana-oncall-app.schedules:read | Read OnCall schedules. |
plugins:grafana-oncall-app:schedules-editor | plugins.app:access grafana-oncall-app.schedules:read grafana-oncall-app.schedules:write grafana-oncall-app.schedules:export | Create, read, update and delete OnCall schedules. |
plugins:grafana-oncall-app:chatops-reader | plugins.app:access grafana-oncall-app.chatops:read | Read OnCall ChatOps. |
plugins:grafana-oncall-app:chatops-editor | plugins.app:access grafana-oncall-app.chatops:read grafana-oncall-app.chatops:write grafana-oncall-app.chatops:update-settings | Read and update OnCall ChatOps. |
plugins:grafana-oncall-app:outgoing-webhooks-reader | plugins.app:access grafana-oncall-app.outgoing-webhooks:read | Read OnCall outgoing webhooks. |
plugins:grafana-oncall-app:outgoing-webhooks-editor | plugins.app:access grafana-oncall-app.outgoing-webhooks:read grafana-oncall-app.outgoing-webhooks:write | Create, read, update and delete OnCall outgoing webhooks. |
plugins:grafana-oncall-app:maintenance-reader | plugins.app:access grafana-oncall-app.maintenance:read | Read OnCall maintenance. |
plugins:grafana-oncall-app:maintenance-editor | plugins.app:access grafana-oncall-app.maintenance:read grafana-oncall-app.maintenance:write | Read and update OnCall maintenance. |
plugins:grafana-oncall-app:api-keys-reader | plugins.app:access grafana-oncall-app.api-keys:read | Read OnCall API keys. |
plugins:grafana-oncall-app:api-keys-editor | plugins.app:access grafana-oncall-app.api-keys:read grafana-oncall-app.api-keys:write | Create, read, update and delete OnCall API keys. Also grants access to be able to consume the OnCall API. |
plugins:grafana-oncall-app:notification-settings-reader | plugins.app:access grafana-oncall-app.notification-settings:read | Read OnCall notification settings. |
plugins:grafana-oncall-app:notification-settings-editor | plugins.app:access grafana-oncall-app.notification-settings:read grafana-oncall-app.notification-settings:write | Read and update OnCall notification settings. |
plugins:grafana-oncall-app:user-settings-reader | plugins.app:access grafana-oncall-app.user-settings:read | Read user’s own OnCall user settings. |
plugins:grafana-oncall-app:user-settings-editor | plugins.app:access grafana-oncall-app.user-settings:read grafana-oncall-app.user-settings:write | Read and update user’s own OnCall user settings. |
plugins:grafana-oncall-app:user-settings-admin | plugins.app:access grafana-oncall-app.user-settings:read grafana-oncall-app.user-settings:write grafana-oncall-app.user-settings:admin | Read and update OnCall user settings for all users. |
plugins:grafana-oncall-app:settings-reader | plugins.app:access grafana-oncall-app.other-settings:read | Read OnCall settings. |
plugins:grafana-oncall-app:settings-editor | plugins.app:access grafana-oncall-app.other-settings:read grafana-oncall-app.other-settings:write | Read and update OnCall settings. |
The following table lists the default RBAC OnCall role assignments to the basic roles:
Basic role | Associated fixed roles | Description |
---|---|---|
Grafana Admin | plugins:grafana-oncall-app:admin | Default Grafana server administrator assignments. |
Admin | plugins:grafana-oncall-app:admin | Default Grafana organization administrator assignments. |
Editor | plugins:grafana-oncall-app:editor | Default Editor assignments. |
Viewer | plugins:grafana-oncall-app:reader | Default Viewer assignments. |