The Managed Cloud security roles
When you request the Managed Cloud environment in Sitecore Support & Self-Service Portal, you must identify your users for the three different security roles by entering their email addresses. Sitecore assigns the relevant access rights for each role. For users to develop for and manage Managed Cloud deployments, they must be assigned one of the following security roles for that Managed Cloud deployment:
-
Devops engineer - usually the technical contact of a Managed Cloud deployment. You must have this super-user security role assigned to one of your users, to be able to work with Managed Cloud.
-
System administrator - user who specializes in specific system management and maintains and scales infrastructure and configurations. They have access to logs and dashboards in addition to the permissions available to developers.
-
Developer - user who is responsible for customizing and deploying solutions into the Managed Cloud deployment. They can introduce changes to the Managed Cloud deployment by creating a git branch and pull request. Pull requests must be approved by a Devops engineer in order to be completed and deployed.
NoteYou can use the Get Access - User service request in Sitecore Support & Self-Service Portal to change the status of a user.
Managed Cloud deployments include one other security role: the Cloudops engineer. This security role is used by Sitecore staff to manage and support your Managed Cloud deployment. Only a limited number of Sitecore employees have the Cloudops engineer role and this role is highly protected within the Sitecore organization.
For non-production environments, all roles mentioned will have ReaderNoACM at the subscription level and ContributorNoACM at the resource group level.
The following table lists the access rights for the security roles in Managed Cloud deployments:
| System admin | Devops engineer | Developer | Cloudops engineer (Sitecore employee) | |
|---|---|---|---|---|
| Git repository for Infrastructure as code | ||||
| Read access | Yes | Yes | Yes | Yes |
| Create branches | Yes | Yes | Yes | Yes |
| Create pull request | Yes | Yes | Yes | Yes |
| Approve pull request | Yes | Yes (Required approval) | Yes | Yes (For Self Service Portal requests) |
| Devops pipelines for deployment automation | ||||
| Run pipeline | No | Yes | No | Yes (For Self Service Portal requests) |
| Stop pipeline | No | Yes | No | Yes (For Self Service Portal requests) |
| Modify pipeline | No | Yes | No | Yes (For maintenance purpose) |
| Azure Portal | ||||
| View MCC resources | Yes | Yes | No | Yes |
| Modify MCC resources | No | No | No | No |
| View other resources | Yes | Yes | No | Yes |
| Modify other resources | Yes | Yes | No | No |
| Kubernetes | ||||
| View deployments using CLI | Yes | Yes | No | Yes |
| Modify deployments using CLI | No | No | No | No |
| Connect underlying infrastructure (for example VMs) | Yes | Yes | No | Yes |
| Key Vault containing secrets | ||||
| Read credentials | No | Yes | No | Yes |
| Modify credentials | No | Yes | No | Yes |
| Storage | ||||
| Read content | No | Yes | No | Yes |
| Modify content | No | Yes | No | Yes |
| Azure Container Registry with custom images | ||||
| Push image | No | Yes | No | Yes |
| Pull image | Yes | Yes | Yes | Yes |
| Delete image | No | Yes | No | No |
| Elastic (stores logs) | ||||
| View logs | Yes | Yes | No | Yes |
| Configure indexes | Yes | Yes | No | Yes |
| SearchStax (provides Solr-as-a-Service) | ||||
| Query data | No | Yes | No | Yes |
| Management API | Yes | Yes | No | Yes |
| Grafana (displays performance metrics) | ||||
| View dashboards | Yes | Yes | No | Yes |
| Edit dashboards | Yes | Yes | No | No |
| Admin | Yes | Yes | No | No |
| Sitecore Experience Platform | ||||
| Login | No | Yes | No | No |
| Disaster Recovery | ||||
| Execution | No | No | No | Yes |