Skip to content

[IAM] Fix account scoped roles #18216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 15, 2024
Merged

[IAM] Fix account scoped roles #18216

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions src/content/docs/fundamentals/setup/manage-members/roles.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ Account-scoped roles apply across an entire Cloudflare account, and through all
| API Gateway | Grants full access to [API Gateway (including API Shield)](/api-shield/) for all domains in an account. |
| API Gateway Read | Grants read access to [API Gateway (including API Shield)](/api-shield/) for all domains in an account. |
| Audit Logs Viewer | Can view [Audit Logs](/fundamentals/setup/account/account-security/review-audit-logs/). |
| Bot Management (Account-wide) | Can edit [Bot Management](/bots/plans/bm-subscription/) (including [Super Bot Fight Mode](/bots/get-started/pro/)) configurations for all domains in account. |
| Bot Management (Account-Wide) | Can edit [Bot Management](/bots/plans/bm-subscription/) (including [Super Bot Fight Mode](/bots/get-started/pro/)) configurations for all domains in account. |
| Billing | Can edit the account’s [billing profile](/fundamentals/subscriptions-and-billing/create-billing-profile/) and subscriptions |
| Cloudflare Access | Can edit [Cloudflare Access](/cloudflare-one/policies/access/) policies. |
| Cache Purge | Can purge the edge cache. |
Expand All @@ -34,7 +34,6 @@ Account-scoped roles apply across an entire Cloudflare account, and through all
| Cloudflare R2 Admin | Can edit Cloudflare [R2](/r2/) buckets, objects, and associated configurations. |
| Cloudflare R2 Read | Can read Cloudflare [R2](/r2/) buckets, objects, and associated configurations. |
| Cloudflare Stream | Can edit [Cloudflare Stream](/stream/) media. |
| Cloudflare Workers Admin | Can edit Cloudflare [Workers](/workers/), [Pages](/pages/), [Durable Objects](/durable-objects/), [KV](/kv/) and [R2](/r2/). Also provides read access to Zones, [Zone Analytics](/analytics/account-and-zone-analytics/zone-analytics/) and [Page Rules](/rules/). |
| Cloudflare Zero Trust | Can edit [Cloudflare for Zero Trust](/cloudflare-one/). |
| Cloudflare Zero Trust PII | Can access [Cloudflare for Zero Trust](/cloudflare-one/) PII. |
| Cloudflare Zero Trust Read Only | Can access [Cloudflare for Zero Trust](/cloudflare-one/) read only mode. |
Expand All @@ -43,7 +42,7 @@ Account-scoped roles apply across an entire Cloudflare account, and through all
| Email Configuration Admin | Grants write access to all of CES, [CASB](/cloudflare-one/applications/scan-apps/), [DLP](/cloudflare-one/policies/data-loss-prevention/), [Gateway](/cloudflare-one/policies/gateway/), and [Tunnels](/cloudflare-one/connections/connect-networks/), except Mail Preview, Raw Email, on-demand reports, actions on emails, and Submissions, Submission Transparency (Requires Cloudflare Zero Trust PII). |
| Email Integration Admin | Grants write access to CES account integration only, [CASB](/cloudflare-one/applications/scan-apps/), [DLP](/cloudflare-one/policies/data-loss-prevention/), [Gateway](/cloudflare-one/policies/gateway/), and [Tunnels](/cloudflare-one/connections/connect-networks/). |
| Email Security Analyst | Grants write access to all of CES, except Settings which is read only (Requires Cloudflare Zero Trust PII). |
| Email Security Read Only | Grants read access to all of CES, but cannot see Raw Email, take action on emails, or make Submissions (Requires Cloudflare Zero Trust PII). |
| Email Security Readonly | Grants read access to all of CES, but cannot see Raw Email, take action on emails, or make Submissions (Requires Cloudflare Zero Trust PII). |
| Email Security Reporting | Grants read access to CES Home, PhishGuard, and Submission Transparency. |
| Firewall | Can edit [WAF](/waf/), [IP Access rules](/waf/tools/ip-access-rules/), [Zone Lockdown](/waf/tools/zone-lockdown/) settings, and [Cache Rules](/cache/how-to/cache-rules/). |
| Load Balancer | Can edit [Load Balancers](/load-balancing/), Pools, Origins, and Health Checks. |
Expand All @@ -57,19 +56,20 @@ Account-scoped roles apply across an entire Cloudflare account, and through all
| Minimal Account Access | Can view account, and nothing else. |
| Page Shield | Grants write access to [Page Shield](/page-shield/) across the whole account. |
| Page Shield Read | Grants read access to [Page Shield](/page-shield/) across the whole account. |
| Hyperdrive Read | Grants read access to [Hyperdrive](/hyperdrive/) database configuration. |
| Hyperdrive Readonly | Grants read access to [Hyperdrive](/hyperdrive/) database configuration. |
| Hyperdrive Admin | Grants write access to [Hyperdrive](/hyperdrive/) database configuration. |
| SSL/TLS, Caching, Performance, Page Rules, and Customization | Can edit most Cloudflare settings except for [DNS](/dns/) and [Firewall](/waf/). |
| Trust and Safety | Can access trust and safety related services. |
| Turnstile | Grants full access to [Turnstile](/turnstile/). |
| Turnstile Read | Grants read access to [Turnstile](/turnstile/). |
| Vectorize Admin | Can edit [Vectorize](/vectorize/) configurations. |
| Vectorize Read only | Can read [Vectorize](/vectorize/) configurations. |
| Vectorize Readonly | Can read [Vectorize](/vectorize/) configurations. |
| Waiting Room Admin | Can edit [Waiting Room](/waiting-room/) configuration. |
| Waiting Room Read | Can read [Waiting Room](/waiting-room/) configuration. |
| Workers Admin | Can edit Cloudflare [Workers](/workers/), [Pages](/pages/), [Durable Objects](/durable-objects/), [KV](/kv/) and [R2](/r2/). Also provides read access to Zones, [Zone Analytics](/analytics/account-and-zone-analytics/zone-analytics/) and [Page Rules](/rules/). |
| Zaraz Admin | Can edit and publish [Zaraz](/zaraz/) configuration. |
| Zaraz Edit | Can edit [Zaraz](/zaraz/) configuration. |
| Zaraz Read | Can read [Zaraz](/zaraz/) configuration. |
| Zaraz Readonly | Can read [Zaraz](/zaraz/) configuration. |
| Zone Versioning (Account-Wide) | Can view and edit [Zone Versioning](/version-management/) for all domains in account. |
| Zone Versioning Read (Account-Wide) | Can view [Zone Versioning](/version-management/) for all domains in account. |

Expand Down
Loading