Roles

Roles are the fundamental building blocks of the ImageFactory permission system. A Role is a named collection of rules that define what actions a subject can perform on specific resources within a customer's environment.

Role Properties

Every role in ImageFactory consists of the following attributes:

• Name: A unique identifier for the role within the customer scope.
• Description: A human-readable explanation of the role's purpose.
• Rules: An array of Rule objects that define the actual permissions.

Rule Structure

A Rule is composed of two primary lists:

1. Actions: A list of operations allowed by this rule.
2. Resources: A list of resource types that the actions can be performed upon.

Permission Enums

To define rules accurately, you must use the supported enum values for actions and resources.

Action Enum Values

Value	Description
VIEW	Allows reading resource details, listing resources, and viewing status.
CREATE	Allows provisioning new resources.
UPDATE	Allows modifying existing resource configurations.
DELETE	Allows removing resources from the system.
ANY	A wildcard that grants all of the above permissions.

Resource Enum Values

Value	Description
ACCOUNT	Cloud provider credentials and account settings.
API_KEY	Programmatic access keys.
AUDIT_LOG	System activity records.
COMPONENT	Image components and scripts.
NOTIFICATION_GROUP	Alerting configurations.
ROLE	Permission set definitions.
ROLE_BINDING	Assignments of roles to subjects.
TEMPLATE	Image definitions and build configs.
VARIABLE	Secure secrets and build variables.
ANY	A wildcard that covers all resource types.

Example Roles

Here are some common role configurations used in production environments.

Admin Role

The Admin role provides full control over all resources.

{
  "name": "CustomerAdmin",
  "description": "Full administrative access to all resources.",
  "rules": [
    {
      "actions": ["ANY"],
      "resources": ["ANY"]
    }
  ]
}

Read-Only Role

Useful for auditors or team members who only need to monitor status.

{
  "name": "ReadOnly",
  "description": "View-only access to all resources.",
  "rules": [
    {
      "actions": ["VIEW"],
      "resources": ["ANY"]
    }
  ]
}

Template Manager Role

Designed for developers who manage image definitions but shouldn't touch credentials or permissions.

{
  "name": "TemplateManager",
  "description": "Manage templates and components.",
  "rules": [
    {
      "actions": ["VIEW", "CREATE", "UPDATE", "DELETE"],
      "resources": ["TEMPLATE", "COMPONENT", "ACCOUNT"]
    },
    {
      "actions": ["VIEW"],
      "resources": ["VARIABLE", "NOTIFICATION_GROUP"]
    }
  ]
}

Managing Roles

To manage roles, navigate to Permissions in the sidebar and select the Roles tab. From here you can view existing roles, create new ones, edit permissions, and delete roles that are no longer needed.

For a detailed walkthrough, see the Permissions guide.

Via API

Roles can also be managed programmatically through the GraphQL API. Below are examples of common operations.

Creating a Role

Use the createRole mutation to define a new permission set.

mutation CreateRole($input: CreateRoleInput!) {
  createRole(input: $input) {
    id
    name
    description
    rules {
      actions
      resources
    }
  }
}

Variables:

{
  "input": {
    "name": "SecurityAuditor",
    "description": "Access to audit logs and resource metadata.",
    "rules": [
      {
        "actions": ["VIEW"],
        "resources": ["AUDIT_LOG", "ANY"]
      }
    ]
  }
}

Listing Roles

Retrieve all roles defined for the current customer.

query ListRoles {
  roles {
    id
    name
    description
  }
}

Updating a Role

Modify the rules or description of an existing role.

mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
  updateRole(id: $id, input: $input) {
    id
    rules {
      actions
      resources
    }
  }
}

Deleting a Role

Remove a role from the system. Note that you cannot delete a role if it is currently referenced by any Role Bindings. You must first remove the bindings before the role can be deleted.

mutation DeleteRole($id: ID!) {
  deleteRole(id: $id)
}