Role-based access control (RBAC)

RisingWave Cloud uses role-based access control (RBAC) to determine what a user or service account can do and where that access applies.

​

RBAC concepts

RBAC combines the following components:

• Security principal: A user or service account. A user typically accesses RisingWave Cloud through the portal. A service account represents an application and authenticates with API keys.
• Role: A predefined set of permissions, such as OrganizationAdmin or ProjectAdmin.
• Scope: The resources to which a role applies. An organization scope includes every project in the organization. A project scope includes only the selected project and its resources.
• Role binding: An assignment of one role to one security principal at one scope.

A principal can have multiple role bindings. The resulting access is additive. For example, a service account can administer two selected projects by having one project-scoped ProjectAdmin binding for each project. Every user and service account in an organization also has a system-managed OrganizationMember role. This baseline role cannot be added or removed manually. Additional role bindings grant access beyond this baseline.

​

Role permissions and limitations

​

Choose a scope

Use an organization scope when a principal needs the same role in every project. For example, an organization-scoped ProjectAdmin can operate all current and future projects without receiving organization administration or billing permissions. Use a project scope to restrict ProjectAdmin access to one project. The binding includes the selected project’s resources, such as clusters, databases, sources, sinks, tables, views, private links, and backups. It does not grant access to any other project.

​

Manage role bindings

Only an OrganizationAdmin can add or remove role bindings. The Access tab lists each role binding with its principal, principal type, role, and scope. You can search the list or filter it by principal, type, or role.

​

Add access

1. Go to Organization and select the Access tab.
2. Click Add access.
3. Under Principal, select a user or service account.
4. Under Role, select a role.
5. Under Scope, select Organization or Project. Project scope is available only for roles that support it.
6. For project scope, select the target project under Scope target.
7. Click Add access.

An equivalent active role binding cannot be added twice. If the principal already has broader access, such as an organization-scoped ProjectAdmin role, an additional project-scoped binding does not grant more permissions.

​

Remove or change access

In the Access tab, find the role binding and select Remove access from its action menu. In the confirmation dialog, click Remove access. Role bindings are immutable. To change a role or scope, remove the existing binding and add a new one. System-managed access, including the baseline OrganizationMember role, cannot be removed. When a project is deleted, RisingWave Cloud deactivates its project-scoped role bindings.

​

Invite users

An invitation can include one or more organization-wide or project-scoped role bindings. After the user accepts the invitation, RisingWave Cloud creates those role bindings and also gives the user the system-managed OrganizationMember role. Invitation role bindings do not grant access before the invitation is accepted. After acceptance, an OrganizationAdmin can add or remove role bindings from the Access tab. For invitation instructions, see Invite and manage users in your organization.

​

Grant access to a service account

A new service account has the system-managed OrganizationMember role. Its API keys use the service account’s combined role bindings. After creating the service account, use the Access tab to grant only the organization-wide or project-scoped roles that the application needs. For service account and API key instructions, see Set up service accounts for applications.