Manage role inheritance

Role inheritance lets you assign project roles to users or groups across all projects in an organization. You do not need to assign roles separately for each project, and assigned roles are automatically applied to projects created later.

Manage role inheritance from the KakaoCloud Console > Management > IAM > Roles > Role inheritance.

Before you begin

Before using role inheritance, review the following requirements:

• You need the Organization Admin or IAM Organization Admin role.
• You can assign project roles through role inheritance. These include Project Admin, Project Member, Project Reader, and project-level service roles. Organization roles cannot be assigned through role inheritance.
• You can assign roles to users and groups registered in the organization. You cannot assign them to service accounts.
• Assigned roles apply equally to all projects in the organization. Follow the principle of least privilege and assign only the roles that are required.

info

Roles assigned through role inheritance are automatically applied to projects created later.

Role inheritance concepts

Assignment paths

A project role can be applied to a user through one of the following four paths. In the console, the Assignment path column and badges identify each path.

Assignment path	Description	Badge	Where to manage
Direct assignment	A role assigned directly to a user in a specific project	User	IAM > Projects > Users on the project details page IAM > Users > Projects on the user details page Project Management > Users
Group	A role applied to a user through membership in a group assigned a role in a specific project	Group (group name)	IAM > Projects > Groups on the project details page IAM > Groups > Projects on the group details page Project Management > Groups
Role inheritance (user)	A role assigned directly to a user through role inheritance - Applies to all projects in the organization	Inherited · User	IAM > Roles > Role inheritance > Users
Role inheritance (group)	A role applied to a user through membership in a group assigned a role through role inheritance - Applies to all projects in the organization	Inherited · Group (group name)	IAM > Roles > Role inheritance > Groups

How to read assignment path badges

• Group name: A badge for a role applied through a group includes the group name, such as Group (dev-team) or Inherited · Group (dev-team). On that group's details page, the badge appears as Group or Inherited · Group without the group name.
• Badge color: A blue badge indicates a role that you can modify or remove from the page you are viewing. A gray badge indicates a role assigned elsewhere, which must be modified or removed from that page. For example, on an IAM > Users details page, a blue User role can be modified there, a gray Inherited · User role can be modified from Roles > Role inheritance > Users, and a gray Group (dev-team) role can be modified from the dev-team group details page.

Role retention rules

Modifying or removing roles from one assignment path does not affect roles assigned through other paths.

• Removing all project roles assigned directly from a project details page does not remove roles assigned through inheritance or other resources.
• Removing a role assigned directly to a user through role inheritance does not remove roles assigned directly in individual projects or roles applied through groups.
• Removing a user from a group or deleting the group stops applying roles through that group. This includes roles assigned to the group through role inheritance. Roles assigned to the user through inheritance or other resources remain in effect.
• The user can no longer access a project if no roles remain for that project.

Role inclusion

Some roles include the permissions of lower-level roles. For example, assigning only Project Admin also grants the permissions of Project Member and Project Reader. Assigning the same role through multiple paths does not grant additional permissions. For role inclusion details, see Project roles.

Assign project roles to users

Assign project roles to a user across all projects in the organization.

1. Go to the KakaoCloud Console > Management > IAM > Roles > Role inheritance > Users.

2. Click [Assign new project role].

3. In Step 1: Specify target and roles, enter the required information and click [Next].

   Field	Description
   Organization	The organization you are currently accessing (automatically entered)
   User	Enter a search term and select the users to assign roles to (up to 100 users). - A user who already has a project role assigned directly through role inheritance is marked Already directly assigned and cannot be selected. To change this user's roles, see Modify project roles.
   Project role	Move one or more roles from Available roles to Selected roles.

4. In Step 2: Review, verify the users and roles, and then click [Assign].

5. Verify the users with assigned roles in the Users list.

info

The role inheritance user list includes both users assigned roles directly and users who belong to groups with assigned roles.

Assign project roles to groups

Assign project roles to a group across all projects in the organization. Assigned roles apply to every user in the group and are automatically applied to users added later.

1. Go to the KakaoCloud Console > Management > IAM > Roles > Role inheritance > Groups.

2. Click [Assign new project role].

3. In Step 1: Specify target and roles, enter the required information and click [Next].

   Field	Description
   Organization	The organization you are currently accessing (automatically entered)
   Group	Enter a search term and select the groups to assign roles to (up to 100 groups). - A group that already has a project role assigned directly through role inheritance is marked Already directly assigned and cannot be selected. To change this group's roles, see Modify project roles.
   Project role	Move one or more roles from Available roles to Selected roles.

4. In Step 2: Review, verify the groups and roles, and then click [Assign].

5. Verify the groups with assigned roles in the Groups list.

caution

When you add a user to a group that has project roles assigned through role inheritance, the user gains access to every project in the organization. A confirmation popup appears in the console when you add the user.

View role inheritance

User list and details

1. Go to the KakaoCloud Console > Management > IAM > Roles > Role inheritance > Users.

2. View the list of users who have project roles assigned directly across all projects in the organization or who belong to groups with those roles.

   Field	Description
   Cloud account	User login ID (email address) - An organization owner has the Owner badge, and your account has the My Account badge.
   ID	Unique ID of the user account
   Name	User name
   Nickname	Nickname used in the organization

3. Select a user to open the details page and view the project roles assigned directly or through groups.

   Field	Description
   Directly assigned roles	Roles assigned directly to the user through role inheritance - You can modify or remove these roles from this page.
   Roles applied through groups	Roles assigned to groups that the user belongs to and applied to the user - Modify or remove these roles from the applicable group.
   Type	Common: Common IAM role Service: Role dedicated to an individual service
   Role	Assigned project role name
   Assignment path	Path through which the role is applied - Inherited · User: Assigned directly through role inheritance - Inherited · Group (group name): Applied through membership in a group assigned a role through role inheritance

Group list and details

1. Go to the KakaoCloud Console > Management > IAM > Roles > Role inheritance > Groups.

2. View the list of groups assigned project roles across all projects in the organization.

   Field	Description
   Name	Group name
   ID	Unique ID of the group
   Users	Number of users in the group
   Description	Description entered when the group was created

3. Select a group to open the details page and view the project roles assigned to that group across all projects in the organization. Assigned roles apply to every user in the group.

   Field	Description
   Type	Common: Common IAM role Service: Role dedicated to an individual service
   Role	Assigned project role name
   Assignment path	Inherited · Group

Modify project roles

Modify project roles assigned directly to a user or group through role inheritance. Roles assigned through inheritance or other resources remain in effect.

1. Go to the KakaoCloud Console > Management > IAM > Roles > Role inheritance > Users or Groups.
2. Select the target from the list and click [Modify project roles]. You can also click [Modify project roles] from the details page.
3. On the Modify project roles page, adjust Available roles and Selected roles, and then click [Next].
4. In Step 2: Review, verify the changes and click [Modify].

Modifying multiple targets at once

When you modify project roles for multiple users or groups at once, all project roles assigned directly through role inheritance are removed and replaced with the newly selected roles. The modification page does not show the current roles of each target. Before proceeding, check the current roles on each details page to avoid applying unintended roles.

Modifying roles for your own account

A confirmation popup appears when you modify the project roles for your own account. If you select roles that do not include permission to manage roles, you might no longer be able to modify your roles or access projects.

Remove all project roles

Remove all project roles assigned directly to a user or group through role inheritance.

1. Go to the KakaoCloud Console > Management > IAM > Roles > Role inheritance > Users or Groups.
2. Select the target from the list and click [Remove all project roles]. You can also click [Remove all project roles] from the details page.
3. In the popup, verify the target and review the following information:
   • All project roles assigned directly to the target through role inheritance are removed.
   • Roles assigned through inheritance or other resources remain in effect.
   • When removing roles from a group, the removed roles no longer apply to users in the group.
   • A user can no longer access a project if no roles remain for that project.
4. Enter Permanently remove and click [Remove].

info

You cannot remove Roles applied through groups from IAM > Roles > Role inheritance > User details. Remove the applicable group roles from Groups under role inheritance, or remove the user from the group.

Display in project details

Project roles assigned through role inheritance also appear in the user and group lists for individual projects.

• From Management > IAM > Projects, select a project and expand a row on the Users or Groups tab to view project roles and assignment paths. Roles applied through role inheritance have an Inherited · User or Inherited · Group (group name) badge.
• The same information appears in the user and group lists in Project Management, on the Projects tab of an IAM > Users details page, and on the Projects tab of an IAM > Groups details page.
• You cannot modify or remove roles assigned through role inheritance from a project details page. Manage them from Roles > Role inheritance.
• [Remove all project roles] on a project details page removes only roles assigned directly in that project. Roles assigned through inheritance or other resources remain in effect.

Considerations

• Roles assigned through role inheritance apply equally to every project in the organization. You cannot exclude specific projects.
• The more projects an organization has, the broader the impact of role inheritance. Assign roles with broad permissions, such as Project Admin, with care.
• An IAM access key stores the roles held by the user when the key is created. Roles stored in the key do not change when the user's roles change later. To use a newly inherited role with an API, create a new IAM access key.
• Assigning, modifying, or removing all roles through role inheritance is recorded as an organization event in Cloud Trail. For users, check the Domain Inherited Role Assign and Domain Inherited Role Unassign events. For groups, check the Domain Inherited Group Assign and Domain Inherited Group Unassign events. For more information, see Service event list.

Related documents

• Role types and permission scopes: Roles and permissions
• Assign roles in an individual project: Manage roles
• Manage group membership: Create and manage groups