Roles

Roles are templates of permissions that control access within CONNECT. You can assign roles to users, clients, and groups.

Each role includes permissions that control access to:

• Services: The services available in the CONNECT platform and the offerings available in the service catalog.

• Resources: The resources available for each service. For example, the Streams Store includes stream and type resources.

• Actions: Actions that an identity can perform upon resources, such as read, write, or delete.  

A role assignment associates an identity with a role. When you create a role assignment, the identity inherits the permissions defined in the role. For more information about role assignments, see Role assignments.

Role best practices

Manage the assignment of roles using the following best practices to minimize security threats and improve ease of management.

• Follow the principle of least privilege

  This principle grants users only the minimum level of access required to perform their tasks. By adhering to this principle when you assign a role, you reduce the risk of unauthorized access or accidental misuse of resources. It enhances security by limiting potential damage that could occur if a user's account is compromised.

  Note: This best practice is particularly important for client credentials; do not assign them administrative privileges.

• Minimize assignment of the Account Administrator role

  This role has broad permissions and control over the entire account. Minimizing its assignment reduces the risk of abuse or accidental misconfiguration that could affect the entire system. It's best practice to limit the number of users with this level of authority to those who truly require it for administrative tasks. Never assign this role to client credential clients.

• Assign client credential clients used for PI to CONNECT Agents write access to stream and asset resources

  The agent must have write permissions to create these resources and write data to them.