> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Roles for Nebius AI Cloud groups

Roles are sets of permissions that are granted to users and service accounts to work with resources in Nebius AI Cloud.

Roles are assigned to [groups](./groups/index):

* **Default groups** in each tenant (`auditors`, `viewers`, `editors`, `admins`) have corresponding predefined [general roles](#general-roles).
* When you create **custom groups**, you should create at least one access permit that assigns a role to the group. You can configure an access permit to apply to the entire tenant, a project within it or an individual resource within it. For more details and instructions, see [Managing custom groups](./groups/manage).

## List of roles

The following roles are available:

* [General](#general-roles)

  * `auditor`
  * `viewer`
  * `editor`
  * `admin`

* [Compute](#compute)

  * `compute.instance-power-operator`

* [Object Storage](#object-storage)

  * `storage.viewer`
  * `storage.uploader`
  * `storage.editor`
  * `storage.object-editor`
  * `storage.object-viewer`
  * `storage.object-lister`

- [MysteryBox](#mysterybox)

  * `mysterybox.payload-viewer`

* [Data Subject Requests](#data-subject-requests)

  * `dsr.admin`

## General roles

*General roles* grant permissions for resources from all services. For example, if you are in a group that has the `admin` role within a tenant, you can perform all actions listed below on all Compute virtual machines, Managed Kubernetes clusters, etc. in the tenant.

The default groups within a tenant are assigned corresponding tenant-wide general roles.

<Warning>
  Default groups and general roles grant a wide range of permissions across all services. To follow the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), create custom groups and assign roles with as few permissions as possible to these groups.
</Warning>

The following general roles are available:

* `auditor`: view **certain types** of resources **without access to data**.
* `viewer`: view **most types** of resources (except some resources related to access management, security, etc.) and **access data** in them (e.g. download objects in buckets).
* `editor`: view **and manage** most types of resources and access data in them.
* `admin`: view and manage **all types** of resources and access data in them.

The graph below shows how general roles are related to each other (the arrow means "is a sub-role of"):

```mermaid theme={null}
graph LR
    classDef default fill:#e0ff4f,stroke-width:0px,color:#111c30;
    auditor --> viewer --> editor --> admin;
```

<Note>
  The `auditor` role is going to be deprecated in the near future. We recommend using the `viewer` role and `viewers` default group instead.
</Note>

General roles contain the following permissions:

<table>
  <thead>
    <tr>
      <td>**Resource type**</td>
      <td>`auditor`<br />(`auditors` default group)</td>
      <td>`viewer`<br />(`viewers` default group)</td>
      <td>`editor`<br />(`editors` default group)</td>
      <td>`admin`<br />(`admins` default group)</td>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>**Compute**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Virtual machines</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
    </tr>

    <tr>
      <td>GPU clusters</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Add/remove VMs<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Add/remove VMs<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Disks</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Attach to/detach from VMs<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Attach to/detach from VMs<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Shared filesystems</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Attach to/detach from VMs<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Attach to/detach from VMs<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Boot disk images</td>
      <td>-</td>
      <td>View<br />Use</td>
      <td>View<br />Use</td>
      <td>View<br />Use</td>
    </tr>

    <tr>
      <td>**Soperator**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Clusters</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
    </tr>

    <tr>
      <td>**Managed Service for Kubernetes**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Clusters</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Node groups</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>**Serverless AI**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Endpoints</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
    </tr>

    <tr>
      <td>Jobs</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Cancel<br />Delete</td>
    </tr>

    <tr>
      <td>**Object Storage**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Buckets</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Delete<br />Undelete<br />Purge</td>
      <td>View<br />Create<br />Delete<br />Undelete<br />Purge</td>
    </tr>

    <tr>
      <td>Objects, versions</td>
      <td>-</td>
      <td>List<br />Download</td>
      <td>List<br />Download<br />Upload<br />Delete<br />Restore</td>
      <td>List<br />Download<br />Upload<br />Delete<br />Restore</td>
    </tr>

    <tr>
      <td>Multipart uploads</td>
      <td>-</td>
      <td>List uploads</td>
      <td>List uploads<br />List parts<br />Create</td>
      <td>List uploads<br />List parts<br />Create</td>
    </tr>

    <tr>
      <td>Transfers</td>
      <td>View transfers<br />View iterations</td>
      <td>View transfers<br />View iterations</td>
      <td>View transfers<br />View iterations<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
      <td>View transfers<br />View iterations<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
    </tr>

    <tr>
      <td>Bucket settings</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Modify</td>
      <td>View<br />Modify</td>
    </tr>

    <tr>
      <td>**Managed Service for PostgreSQL®**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Clusters</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
    </tr>

    <tr>
      <td>**Container Registry**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Registries</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Images</td>
      <td>-</td>
      <td>List<br />Pull</td>
      <td>List<br />Pull<br />Push<br />Modify</td>
      <td>List<br />Pull<br />Push<br />Modify</td>
    </tr>

    <tr>
      <td>**Managed Service for MLflow**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Clusters</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Stop<br />Start</td>
      <td>View<br />Stop<br />Start<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>**Applications**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Standalone applications</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Stop<br />Start<br />Delete</td>
    </tr>

    <tr>
      <td>Applications for Managed Kubernetes</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Create/delete endpoints<br />Delete</td>
      <td>View<br />Create<br />Create/delete endpoints<br />Delete</td>
    </tr>

    <tr>
      <td>**Observability**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Metrics</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Alerts</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Logs</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Write</td>
      <td>View<br />Write</td>
    </tr>

    <tr>
      <td>**Virtual Networks**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>IP address pools</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>IP address allocations</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Assign to/de-assign from resources<br />Delete</td>
      <td>View<br />Create<br />Assign to/de-assign from resources<br />Delete</td>
    </tr>

    <tr>
      <td>Networks</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Subnets</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Use<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Use<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Routing tables</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Assign to subnets<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Assign to subnets<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Routes</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Security groups</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Assign to VMs<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Assign to VMs<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Security rules</td>
      <td>-</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>**Billing**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Billing details – general:<br />payer type, country, payment method, etc.</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Billing details – sensitive:<br />payer name, billing address, etc.</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Documents</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Prices</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Pay-as-you-go balance</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Usage details</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Transactions</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>**Identity and Access Management**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Users</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Groups</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Add members<br />Remove members</td>
    </tr>

    <tr>
      <td>Service accounts</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Authorized keys</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Upload<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>Access keys</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr data-audience="draft">
      <td>IAM tokens</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
      <td>View<br />Create<br />Modify<br />Delete</td>
    </tr>

    <tr>
      <td>**Audit Logs**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Events</td>
      <td>-</td>
      <td>-</td>
      <td>-</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Exports</td>
      <td>-</td>
      <td>-</td>
      <td>-</td>
      <td>View<br />Create</td>
    </tr>

    <tr>
      <td>**MysteryBox**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Secrets</td>
      <td>View<br />List</td>
      <td>View<br />List</td>
      <td>View<br />List<br />Create<br />Update<br />Delete<br />Restore</td>
      <td>View<br />List<br />Create<br />Update<br />Delete<br />Restore</td>
    </tr>

    <tr>
      <td>Versions</td>
      <td>View<br />List</td>
      <td>View<br />List</td>
      <td>View<br />List<br />Create<br />Delete<br />Restore</td>
      <td>View<br />List<br />Create<br />Delete<br />Restore</td>
    </tr>

    <tr>
      <td>Payloads</td>
      <td>-</td>
      <td>-</td>
      <td>-</td>
      <td>View</td>
    </tr>

    <tr>
      <td>**Quotas**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Limits</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View</td>
    </tr>

    <tr>
      <td>Requests</td>
      <td>-</td>
      <td>View</td>
      <td>View</td>
      <td>View<br />Create<br />Cancel</td>
    </tr>

    <tr>
      <td>**Support**</td>
      <td>`auditor`</td>
      <td>`viewer`</td>
      <td>`editor`</td>
      <td>`admin`</td>
    </tr>

    <tr>
      <td>Regular requests</td>
      <td>View<br />Create<br />Comment<br />Attach files<br />Close</td>
      <td>View<br />Create<br />Comment<br />Attach files<br />Close</td>
      <td>View<br />Create<br />Comment<br />Attach files<br />Close</td>
      <td>View<br />Create<br />Comment<br />Attach files<br />Close</td>
    </tr>

    <tr>
      <td>Data Subject Requests to receive copies of data</td>
      <td>-</td>
      <td>-</td>
      <td>-</td>
      <td>View<br />Create<br />Comment<br />Attach files<br />Close</td>
    </tr>

    <tr>
      <td>Data Subject Requests to erase data</td>
      <td>-</td>
      <td>-</td>
      <td>-</td>
      <td>View<br />Create<br />Comment<br />Attach files<br />Close</td>
    </tr>
  </tbody>
</table>

## Compute

*Compute roles* grant permissions for [Compute](/compute) virtual machines.

The only available role is `compute.instance-power-operator`, which allows you to perform power operations on virtual machines without broader Compute permissions.

`compute.instance-power-operator` contains the following permissions:

| **Compute**      | `compute.instance-power-operator`                                 |
| ---------------- | ----------------------------------------------------------------- |
| Virtual machines | View<br />View metadata<br />Start<br />Stop<br />View operations |

## Object Storage

*Object Storage roles* grant permissions for [Object Storage](/object-storage) buckets and objects.

The following Object Storage roles are available:

* `storage.object-viewer`: download objects and view their metadata
* `storage.object-lister`: list objects and view their version metadata
* `storage.viewer`: view buckets, list and download objects but not upload them
* `storage.uploader`: view buckets, upload objects but not list or download them
* `storage.object-editor`: view buckets, list, download, upload and manage objects
* `storage.editor`: view and manage buckets, list, download, upload and manage objects

The graph below shows how Object Storage roles are related to each other and to general roles, shown in green (the arrow means "is a sub-role of"):

```mermaid theme={null}
graph LR
    classDef default fill:#dbefff,stroke-width:0px,color:#111c30;
    classDef general fill:#e0ff4f;
    
    storage.editor --> editor;
    storage.viewer --> viewer;
    storage.viewer --> storage.object-editor;
    viewer --> editor;
    storage.uploader --> storage.object-editor;
    storage.object-editor --> storage.editor;
    storage.object-viewer --> storage.viewer;
    storage.object-lister --> storage.viewer;
    
    class editor general;
    class viewer general;
```

Object Storage roles contain the following permissions:

| **Object Storage** | `storage.object-viewer` | `storage.object-lister` | `storage.viewer`   | `storage.uploader`     | `storage.object-editor`                                 | `storage.editor`                                        |
| ------------------ | ----------------------- | ----------------------- | ------------------ | ---------------------- | ------------------------------------------------------- | ------------------------------------------------------- |
| Buckets            | -                       | -                       | View               | View                   | View                                                    | View<br />Create<br />Delete                            |
| Objects, versions  | Download                | List                    | List<br />Download | Upload                 | List<br />Download<br />Upload<br />Delete<br />Restore | List<br />Download<br />Upload<br />Delete<br />Restore |
| Multipart uploads  | -                       | -                       | List uploads       | List parts<br />Create | List uploads<br />List parts<br />Create                | List uploads<br />List parts<br />Create                |
| Transfers          | -                       | -                       | -                  | -                      | -                                                       | -                                                       |
| Bucket settings    | -                       | -                       | View               | View                   | View                                                    | View<br />Modify                                        |

For more details on the actions available to different roles, see [Actions supported by Object Storage roles](/object-storage/supported-actions).

If you want to configure fine-grained access to objects in a bucket, apply a [bucket policy](/object-storage/buckets/bucket-policy) in Object Storage.

## MysteryBox

*MysteryBox roles* grant permissions for [MysteryBox](../../mysterybox) secrets.

The only available role is `mysterybox.payload-viewer`, which is a sub-role of the `admin` general role.

`mysterybox.payload-viewer` contains the following permissions:

| **MysteryBox** | `mysterybox.payload-viewer` |
| -------------- | --------------------------- |
| Secrets        | -                           |
| Versions       | -                           |
| Payloads       | View                        |

<Warning>
  Creating a secret or a version of a secret does not automatically grant you access to view payloads in that secret or version. The `editor` role is enough to create a secret or a version, but viewing payloads requires the `mysterybox.payload-viewer` role, which is a sub-role of `admin` but not `editor`.
</Warning>

## Data Subject Requests

*Roles for Data Subject Requests* (DSRs) grant permissions to receive copies of personal and non-personal data stored in a tenant and its resources in a machine-readable format, and erase the data if required. If you represent a legal entity and want to [send a DSR](../../overview/support#data-subject-requests-dsrs), you need a role for DSRs.

The only available role for DSRs is `dsr.admin`, which allows you to create Data Subject Requests and general support requests. It is a sub-role of the `admin` general role.

`dsr.admin` contains the following permissions:

| **Support**                                     | `dsr.admin`                                                |
| ----------------------------------------------- | ---------------------------------------------------------- |
| Regular requests                                | View<br />Create<br />Comment<br />Attach files<br />Close |
| Data Subject Requests to receive copies of data | View<br />Create<br />Comment<br />Attach files<br />Close |
| Data Subject Requests to erase data             | View<br />Create<br />Comment<br />Attach files<br />Close |

<Warning>
  The `dsr.admin` role allows you to receive copies of and erase **all** personal and non-personal data in the tenant. Assign this role with caution.
</Warning>

***

*Postgres, PostgreSQL and the Slonik Logo are trademarks or registered trademarks of the PostgreSQL Community Association of Canada, and used with their permission.*