Roles and permissions
KakaoCloud IAM uses a role-based access control (RBAC) model, which classifies roles based on the management scope and purpose of resources such as organizations, projects, and services. Each role type has a different scope and set of permissions, and multiple roles can be combined for more granular access control.
The following table summarizes the scope and key permissions of each major role type.
| Role type | Scope | Key permissions | Examples |
|---|---|---|---|
| Organization role | Organization level | - Manage users, groups, roles, projects, and billing - Control IAM organization resources | Organization admin, Billing admin |
| Project role | Project level | - Create, modify, delete project resources - Control IAM project resources | Project admin, Project reader |
| Service role | Service level | - Create, manage, and operate service-specific resources | Object Storage manager, Pub/Sub publisher |
Roles are generally assigned to users or groups at the organization or project level. Use service roles selectively when service-specific access or IAM resource control is required.
- Start by assigning an organization or project role, then add service roles if access to specific services or IAM resources is required.
- IAM roles can be combined with other roles, but should always follow the principle of least privilege.
Assignment paths
Project roles are applied to users through the following three paths. The project role table in the console identifies each path in the Assignment path column.
| Assignment path | Description | Where to manage |
|---|---|---|
| Direct assignment | Assigned directly to a user in a specific project | IAM > Project > Project details > Users and groups Project Management > Users and groups |
| Group | Applied through membership in a group assigned a project role | IAM > Project > Project details > Groups Project Management > Groups |
| Role inheritance | Assigned to a user or group as a project role that applies across all projects in the organization Automatically applies to newly created projects | IAM > Roles > Role inheritance > Users IAM > Roles > Role inheritance > Groups |
Removing a role from one path does not remove a role assigned through another path. A blue assignment path badge indicates a role that can be edited on the current page; a gray badge indicates that you must move to the page where the role was assigned. Roles applied through a group display the group name, such as Group(dev-team), even outside the group page.
For details, see Manage role inheritance.
View role details
Click a role type below to view detailed permissions and components.
📄️ Organization roles
Roles for managing organization-level resources, users, and billing-related functions.
📄️ Project roles
Defines permissions for creating, modifying, deleting, and viewing project resources.
📄️ Service roles
Roles used to manage or restrict permissions for specific cloud service resources.