You are viewing an outdated version of the documentation.

This documentation is for an older version (1.4.7) of Dagster. You can view the version of this page from our latest release below.

Understanding role-based access control in Dagster Cloud#

This guide is applicable to Dagster Cloud.

Role-based access control (RBAC) enables you to grant specific permissions to users in your organization, ensuring that Dagster users have access to what they require in Dagster Cloud, and no more.

In this guide, we'll cover how RBAC works in Dagster Cloud, how to assign roles to users, and the granular permissions for each user role.


Dagster Cloud user roles#

Dagster Cloud uses a hierarchical model for RBAC, meaning that the most permissive roles include permissions from the roles beneath them. The following user roles are currently supported, in order from the most permissive to the least permissive:

  • Organization Admin
  • Admin
  • Editor
  • Launcher (Enterprise plans only)
  • Viewer (Enterprise plans only)

For example, the Admin user role includes permissions specific to this role and all permissions in the Editor, Launcher, and Viewer user roles. Refer to the User permissions reference for the full list of user permissions in Dagster Cloud.

User role enforcement#

All user roles are enforced both in Dagster Cloud and the GraphQL API.

Teams#

Dagster Cloud Enterprise users can create teams of users and assign default permission sets. Refer to the Managing teams in Dagster Cloud guide for more info.


Assigning user and team roles#

With the exception of the Organization Admin role, user and team roles are set on a per-deployment basis.

Organization Admins have access to the entire organization, including all full deployments, code locations, and Branch Deployments.

LevelPlanDescription
DeploymentAll plansDefines the level of access for a given deployment. Roles set at this level will be the default role for the user or team for all code locations in the deployment.

Note: Granting access to a deployment grants a minimum of Viewer access to all code locations. Preventing access for specific code locations isn't currently supported. Additionally, having access to a deployment doesn't grant access to Branch Deployments - those permissions must be granted separately.
Code locationEnterpriseDefines the level of access for a given code location in a deployment.

Dagster Cloud Enterprise users can override the default deployment-level role for individual code locations. For example, if the Deployment role is Launcher, you could override this role with a more permissive role, such as Editor or Admin.

For non-Enterprise users, users will have the same level of access for all code locations in a deployment.
Branch deploymentsAll plansDefines the level of access for all Branch Deployments in the code locations the user or team has access to.

Applying role overrides#

This section is applicable to Dagster Cloud Enterprise.

As previously mentioned, you can define individual user roles for users in your organization. You can also apply permission overrides to grant specific exceptions.

Overrides may be used to apply a more permissive role. If, for example, the default role is Admin or Organization Admin, overrides will be disabled as these are the most permissive roles.

Code locations#

To override a code location role for an individual user:

  1. Locate the user in the list of users.
  2. Click Edit.
  3. Click the toggle to the left of the deployment to open a list of code locations.
  4. Next to a code location, click Edit user role.
  5. Select the user role for the code location: Overriding the Viewer user role for a code location
  6. Click Save.

Team members#

Users in your organization can belong to one or more teams. When determining a user's level of access, Dagster Cloud will use the most permissive role assigned to the user between all of their team memberships and any individual role grants.

For example, let's look at a user with the following roles for our dev deployment:

  • Team 1: Launcher
  • Team 2: Viewer
  • Individual: Viewer

In this example, the user would have Launcher access to the prod deployment. This is because the Launcher role is more permissive than Viewer.

The above also applies to code locations and Branch Deployment roles.

Viewing overrides#

To view deployment-level overrides for a specific user, locate the user on the Users page and hover over a deployment:

Deployment overrides popup in Dagster Cloud

If there are code location-level overrides, a small N override(s) link will display beneath the user's deployment role. Hover over it to display the list of overrides:

Code location overrides popup in Dagster Cloud

Removing overrides#

  1. Locate the user in the list of users.
  2. Click Edit.
  3. To remove an override:
    • For a deployment, click Edit user role next to the deployment.
    • For a code location, click the toggle next to the deployment to display a list of code locations. Click Edit user role next to the code location.
  4. Click the Remove override button.
  5. Click Save.

User permissions reference#

General#

 ViewerLauncherEditorAdminOrganization
Admin
View runs of jobs
Launch, re-execute, terminate, and delete runs of jobs
Start and stop schedules
Start and stop sensors
Wipe assets
Launch and cancel backfills
Add dynamic partitions

Deployments#

Deployment settings are accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Deployments.

 ViewerLauncherEditorAdminOrganization
Admin
View deployments
Modify deployment settings
Create, edit, delete environment variables
View environment variable values
Export environment variables
Create and delete deployments

Code locations#

Code locations are accessed in the UI by navigating to Deployment > Code locations.

 ViewerLauncherEditorAdminOrganization
Admin
View code locations
Create and remove code locations
Reload code locations and workspaces

Agent tokens#

Agent tokens are accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Tokens.

 ViewerLauncherEditorAdminOrganization
Admin
View agent tokens
Create agent tokens
Edit agent tokens
Revoke agent tokens

User tokens#

User tokens are accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Tokens.

 ViewerLauncherEditorAdminOrganization
Admin
View and create own user tokens
List all user tokens
Revoke all user tokens

Users#

User management is accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Users.

 ViewerLauncherEditorAdminOrganization
Admin
View users
Add users
Edit user roles
Remove users

Teams#

Team management is accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Teams.

Note: Admin users can modify teams only in deployments where they're an Admin.

 ViewerLauncherEditorAdminOrganization
Admin
View teams
Modify team permissions
Create teams
Re-name teams
Add/remove team members
Remove teams

Workspace administration#

 ViewerLauncherEditorAdminOrganization
Admin
Manage alerts
Edit workspace
Administer SAML
Manage SCIM
View usage
Manage billing