Creating roles and policies

Overview

This topic explains how to create roles and policies in LaunchDarkly.

Create roles

To give an account member custom permissions in LaunchDarkly, you must assign them a role.

LaunchDarkly provides both project and organization preset roles. We think these roles will be satisfactory for most organizations. They provide permissions based on typical “personas” for members using LaunchDarkly, including Project Admin, Maintainer, Developer, Contributor, and Viewer.

If the permissions that these preset roles provide are not quite what works best for your organization, you add policy statements to these roles. To learn how, read Editing roles. You can also create your own roles.

To create a new role:

1. Click the gear icon in the left sidenav to view Organization settings.
2. Click Roles.
3. Click New role. The “New role” page appears:

4. Enter a human-readable Name for the role.
5. Enter a Key for the role.
6. (Optional) Enter a Description to explain what the role does.
7. (Optional) Click Advanced to open the “Scope using attribute key” section. Then click + Add resource type and select a resource type from the menu.

• If multiple members or teams should have similar permissions, but work with different resources, setting the role scope lets you reuse the same custom role. For example, suppose Member A should have access to all actions on flags in Project A, and Member B should have access to all actions on flags in Project B. You can create one role with access to all actions on flags, and set a role scope of project. Then, you can specify Project A when you assign this role to Member A, and specify Project B when you assign this role to Member B. To learn more, read Role concepts and Using role scope.

8. Create a policy using the policy builder, following the procedure below.
9. Click Create role.

Create policies for roles

Policies are sets of statements that describe the actions a role is allowed or not allowed to take on specified resources. You can use the Policy builder to add policy statements to new or existing roles.

By default, roles cannot take any actions on any resources. You must create a policy that provides the level of access you prefer.

To create a policy:

1. Complete steps 1-8 in Create roles, above.
2. In the “Edit Policy” panel, click + Add statement.
3. Use the Scope menu to specify the resources this policy affects.

• Select the resource type.
• In the Select an operation menu, select whether the scope of the statement should be all resources of this type, all resources except for a select few, or only a select few.
• If necessary, choose these select few from the Select [resources] menu.
  • If you select the “project” resource type, you can only select one project. To create a policy for multiple projects, use the advanced editor, or use a role scope and specify multiple projects when you apply this role to members or teams.
• Some resources require you to specify other resources in order to be correctly identified.
  • For example, if you initially select the “flag” resource type, the policy builder prompts you to specify projects and environments before you can continue. If you have set a role scope of “project”, then projects are listed in the policy builder as being assigned separately. You cannot specify them here.
  • If you select the “project” resource type, no other information is needed.
  • To learn more, read Using resources.

4. Use the Actions menu to specify whether to allow or deny actions on these resources.

• Select “ALLOW” or “DENY.”
• In the Select an operation menu, select whether to allow or deny all actions, all actions except for a select few, or only a select few.
• If necessary, choose these select few from the Select actions menu.

5. (Optional) Repeat steps 2-4 to add additional statements to your policy.
6. Click Create role.

View role details

You can view details about an existing role and its policies. You can also view each action the role can perform and what that action does.

To view details for roles from the Roles page:

1. Click the gear icon in the left sidenav to view Organization settings.
2. Click Roles and find the role you wish to view. Select the Project or Organization tab as needed.
3. Click the name of the role. A summary of the role and its policy statements appears.
4. (Optional) To make updates to the role or its policy statements, click the pencil icon to open the “Edit role” page.

You can also view details for roles from the Access tab for a given member:

1. Navigate to the Members list.
2. Click the name of a member.
3. On the Access tab for the member, click the name of a role. A summary of the role and its policy statements appears.
4. (Optional) To make updates to the role or its policy statements, click the pencil icon to open the “Edit role” page.

Add, view, and remove an account member’s roles

To learn how to add a role to an account member, read Assigning roles to members.

To learn how to view the roles for an individual account member, read Viewing member roles.

To learn how to remove a role from an account member, read Removing member roles.