Assign a Custom RBAC Role to a Team
A 5-step recipe with Grafana. We can help you get access.
Recipe · 5 steps
Assign a Custom RBAC Role to a Team
with Grafana · Identity & Access Management
Create a custom RBAC role and bind it to a team.
- Create the custom role with an explicit list of actions and scopes. Keep the permission list narrow; this is the whole reason for not handing out Admin.
- Read the role back by UID to confirm the permissions Grafana actually stored, which is not always the list you sent if an action name was wrong.
- Resolve the team by name, since role assignment addresses teams by a numeric id that differs between instances.
- Set the team's roles. This replaces the team's custom role assignments with the supplied list rather than appending to them, so send the full set you want the team to end up with.
- List the team's roles to prove the binding exists. Everyone on the team now holds these permissions, and anyone who leaves the team loses them.
What you'll need to have ready
- roleName: Role name. Custom roles are conventionally prefixed with "custom:" (e.g. "custom:dashboards.reader").
- displayName: Human-friendly name shown in the UI.
- description: What the role is for, which future-you will want.
- group: Group the role is listed under in the UI (e.g. "Dashboards").
- permissions: The actions and scopes the role grants, each an object with an "action" and an optional "scope" (e.g. {"action": "dashboards:read", "scope": "dashboards:*"}).
- uid: Optional stable UID for the role.
- global: Create the role across all organizations rather than only the current one.
- version: Version number for the role definition.
- teamName: Name of the team to assign the role to.
- includeHidden: Include hidden roles when replacing the team's role set.
For your developer
Arazzo workflow grafana:assign-custom-role-to-team, 5 operations: createRole → getRole → searchTeams → setTeamRoles → listTeamRoles. Specs on APIs.io.