diff --git a/website/docs/docs/cloud/secure/environment-permissions-setup.md b/website/docs/docs/cloud/secure/environment-permissions-setup.md new file mode 100644 index 00000000000..01ad3e6aef0 --- /dev/null +++ b/website/docs/docs/cloud/secure/environment-permissions-setup.md @@ -0,0 +1,65 @@ +--- +title: "Set up environment-level permissions" +id: environment-permissions-setup +description: "Set up environment-level permissions to protect your information" +sidebar_label: "Set up environment-level permissions" +pagination_next: null +pagination_prev: null +--- + +# Set up environment-level permissions + +:::note + +This is a beta feature available to select dbt Cloud Enterprise customers. If you are interested in beta testing this feature, please contact your account manager. + +::: + +To set up and configure environment-level permissions, you must have write permissions to the **Groups & Licenses** settings of your dbt Cloud account. For more information about roles and permissions, check out [User permissions and licenses](/docs/cloud/manage-access/seats-and-users). + +Environment-level permissions are not the same as account-level [role-based access control (RBAC)](/docs/cloud/manage-access/about-user-access#role-based-access-control) and are configured separately from those workflows. + +## Setup instructions + +In your dbt Cloud account: + +1. Open the **gear menu** and select **Account settings**. From the left-side menu, select **Groups & Licenses**. While you can edit existing groups, we recommend not altering the default `Everyone`, `Member`, and `Owner` groups. + + + +2. Create a new or open an existing group. If it's a new group, give it a name, then scroll down to **Access & permissions**. Click **Add**. + + + +3. Select the **Permission set** for the group. Only the following permissions sets can have environment-level permissions configured: + +- Database admin +- Git admin +- Team admin +- Analyst +- Developer + +Other permission sets are restricted because they have access to everything (for example, Account admin), or limitations prevent them from having write access to environments (for example, Account viewer). + +If you select a permission set that is not supported, the environment permission option will not appear. + + + +4. Select the **Environment** for group access. The default is **All environments**, but you can select multiple. If none are selected, the group will have read-only access. Note that `Other` maps to the `General` environment type. + + + +5. Save the Group settings. You're now setup and ready to assign users! + +## User experience + +Users with permissions to the environment will see all capabilities assigned to their role. The environment-level permissions are `write` or `read-only` access. This feature does not currently support determining which features in the environment are accessible. For more details on what can and can not be done with environment-level permissions, refer to [About environment-permissions](/docs/cloud/secure/environment-permissions). + +For example, here is an overview of the **Jobs** section of the environment page if a user has been granted access: + + + +The same page if the user has not been granted environment-level permissions: + + + diff --git a/website/docs/docs/cloud/secure/environment-permissions.md b/website/docs/docs/cloud/secure/environment-permissions.md index 64199398c0e..b54a48d04e5 100644 --- a/website/docs/docs/cloud/secure/environment-permissions.md +++ b/website/docs/docs/cloud/secure/environment-permissions.md @@ -17,6 +17,8 @@ This is a beta feature available to select dbt Cloud Enterprise customers. If yo Environment-level permissions give dbt Cloud admins the ability to grant write permission to groups and service tokens for specific [environment types](/docs/dbt-cloud-environments) within a project. Granting access to an environment give users access to all environment-level write actions and resources associated with their assigned roles. For example, users with a Developer role can create and run jobs within the environment(s) they have access to. For all other environments, those same users will have read-only access. +For configuration instructions, check out the [setup page](/docs/cloud/secure/environment-permissions-setup). + ## Current limitations Environment-level permissions give dbt Cloud admins more flexibility to protect their environments, but it's important to understand that there are some limitations to this feature, so those admins can make informed decisions about granting access. @@ -80,3 +82,7 @@ With mixed access across projects: - **Other Admins:** A user (non-Admin) can have access to multiple projects depending on the requirements. If the user has the same roles across projects, you can apply environment access across all projects. + + +## Related docs +-[Environment-level permissions setup](/docs/cloud/secure/environment-permissions-setup) \ No newline at end of file diff --git a/website/static/img/docs/dbt-cloud/add-permissions.png b/website/static/img/docs/dbt-cloud/add-permissions.png new file mode 100644 index 00000000000..40bf518f005 Binary files /dev/null and b/website/static/img/docs/dbt-cloud/add-permissions.png differ diff --git a/website/static/img/docs/dbt-cloud/environment-options.png b/website/static/img/docs/dbt-cloud/environment-options.png new file mode 100644 index 00000000000..0d1a342e60b Binary files /dev/null and b/website/static/img/docs/dbt-cloud/environment-options.png differ diff --git a/website/static/img/docs/dbt-cloud/groups-and-licenses.png b/website/static/img/docs/dbt-cloud/groups-and-licenses.png new file mode 100644 index 00000000000..93f38d2b165 Binary files /dev/null and b/website/static/img/docs/dbt-cloud/groups-and-licenses.png differ diff --git a/website/static/img/docs/dbt-cloud/no-option.png b/website/static/img/docs/dbt-cloud/no-option.png new file mode 100644 index 00000000000..d540ad96e0f Binary files /dev/null and b/website/static/img/docs/dbt-cloud/no-option.png differ diff --git a/website/static/img/docs/dbt-cloud/read-only-access.png b/website/static/img/docs/dbt-cloud/read-only-access.png new file mode 100644 index 00000000000..226adf57c88 Binary files /dev/null and b/website/static/img/docs/dbt-cloud/read-only-access.png differ diff --git a/website/static/img/docs/dbt-cloud/write-access.png b/website/static/img/docs/dbt-cloud/write-access.png new file mode 100644 index 00000000000..a2512219280 Binary files /dev/null and b/website/static/img/docs/dbt-cloud/write-access.png differ