Understanding role-based access control in Dagster Cloud#

This guide is applicable to Dagster Cloud.

Role-based access control (RBAC) enables you to grant specific permissions to users in your organization, ensuring that Dagster users have access to what they require in Dagster Cloud, and no more.

In this guide, we'll cover how RBAC works in Dagster Cloud, how to assign roles to users, and the granular permissions for each user role.

Dagster Cloud user roles#

Dagster Cloud uses a hierarchical model for RBAC, meaning that the most permissive roles include permissions from the roles beneath them. The following user roles are currently supported, in order from the most permissive to the least permissive:

Organization Admin
Admin
Editor
Launcher (Enterprise plans only)
Viewer (Enterprise plans only)

For example, the Admin user role includes permissions specific to this role and all permissions in the Editor, Launcher, and Viewer user roles. Refer to the User permissions reference for the full list of user permissions in Dagster Cloud.

User role enforcement#

All user roles are enforced both in Dagster Cloud and the GraphQL API.

Teams#

Dagster Cloud Enterprise users can create teams of users and assign default permission sets. Refer to the Managing teams in Dagster Cloud guide for more info.

Assigning user and team roles#

With the exception of the Organization Admin role, user and team roles are set on a per-deployment basis.

Organization Admins have access to the entire organization, including all full deployments, code locations, and Branch Deployments.

Level	Plan	Description
Deployment	All plans	Defines the level of access for a given deployment. Roles set at this level will be the default role for the user or team for all code locations in the deployment. Note: Granting access to a deployment grants a minimum of Viewer access to all code locations. Preventing access for specific code locations isn't currently supported. Additionally, having access to a deployment doesn't grant access to Branch Deployments - those permissions must be granted separately.
Code location	Enterprise	Defines the level of access for a given code location in a deployment. Dagster Cloud Enterprise users can override the default deployment-level role for individual code locations. For example, if the Deployment role is Launcher, you could override this role with a more permissive role, such as Editor or Admin. For non-Enterprise users, users will have the same level of access for all code locations in a deployment.
Branch deployments	All plans	Defines the level of access for all Branch Deployments in the code locations the user or team has access to.

Applying role overrides#

This section is applicable to Dagster Cloud Enterprise.

As previously mentioned, you can define individual user roles for users in your organization. You can also apply permission overrides to grant specific exceptions.

Overrides may be used to apply a more permissive role. If, for example, the default role is Admin or Organization Admin, overrides will be disabled as these are the most permissive roles.

Code locations#

To override a code location role for an individual user:

Locate the user in the list of users.
Click Edit.
Click the toggle to the left of the deployment to open a list of code locations.
Next to a code location, click Edit user role.
Select the user role for the code location:
Click Save.

Team members#

Users in your organization can belong to one or more teams. When determining a user's level of access, Dagster Cloud will use the most permissive role assigned to the user between all of their team memberships and any individual role grants.

For example, let's look at a user with the following roles for our dev deployment:

Team 1: Launcher
Team 2: Viewer
Individual: Viewer

In this example, the user would have Launcher access to the prod deployment. This is because the Launcher role is more permissive than Viewer.

The above also applies to code locations and Branch Deployment roles.

Viewing overrides#

To view deployment-level overrides for a specific user, locate the user on the Users page and hover over a deployment:

Deployment overrides popup in Dagster Cloud

If there are code location-level overrides, a small N override(s) link will display beneath the user's deployment role. Hover over it to display the list of overrides:

Code location overrides popup in Dagster Cloud

Removing overrides#

Locate the user in the list of users.
Click Edit.
To remove an override:
- For a deployment, click Edit user role next to the deployment.
- For a code location, click the toggle next to the deployment to display a list of code locations. Click Edit user role next to the code location.
Click the Remove override button.
Click Save.

User permissions reference#

General#

	Viewer	Launcher	Editor	Admin	Organization Admin
View runs of jobs	✅	✅	✅	✅	✅
Launch, re-execute, terminate, and delete runs of jobs	❌	✅	✅	✅	✅
Start and stop schedules	❌	❌	✅	✅	✅
Start and stop sensors	❌	❌	✅	✅	✅
Wipe assets	❌	❌	✅	✅	✅
Launch and cancel backfills	❌	❌	✅	✅	✅
Add dynamic partitions	❌	❌	✅	✅	✅

Deployments#

Deployment settings are accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Deployments.

	Viewer	Launcher	Editor	Admin	Organization Admin
View deployments	✅	✅	✅	✅	✅
Modify deployment settings	❌	❌	✅	✅	✅
Create, edit, delete environment variables	❌	❌	✅	✅	✅
View environment variable values	❌	❌	✅	✅	✅
Export environment variables	❌	❌	✅	✅	✅
Create and delete deployments	❌	❌	❌	❌	✅

Code locations#

Code locations are accessed in the UI by navigating to Deployment > Code locations.

	Viewer	Launcher	Editor	Admin	Organization Admin
View code locations	✅	✅	✅	✅	✅
Create and remove code locations	❌	❌	✅	✅	✅
Reload code locations and workspaces	❌	❌	✅	✅	✅

Agent tokens#

Agent tokens are accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Tokens.

	Viewer	Launcher	Editor	Admin	Organization Admin
View agent tokens	❌	❌	❌	❌	✅
Create agent tokens	❌	❌	❌	❌	✅
Edit agent tokens	❌	❌	❌	❌	✅
Revoke agent tokens	❌	❌	❌	❌	✅

User tokens#

User tokens are accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Tokens.

	Viewer	Launcher	Editor	Admin	Organization Admin
View and create own user tokens	❌	❌	✅	✅	✅
List all user tokens	❌	❌	❌	✅	✅
Revoke all user tokens	❌	❌	❌	✅	✅

Users#

User management is accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Users.

	Viewer	Launcher	Editor	Admin	Organization Admin
View users	✅	✅	✅	✅	✅
Add users	❌	❌	❌	✅	✅
Edit user roles	❌	❌	❌	❌	✅
Remove users	❌	❌	❌	❌	✅

Teams#

Team management is accessed in the UI by navigating to user menu (your icon) > Cloud Settings > Teams.

Note: Admin users can modify teams only in deployments where they're an Admin.

	Viewer	Launcher	Editor	Admin	Organization Admin
View teams	✅	✅	✅	✅	✅
Modify team permissions	❌	❌	❌	✅	✅
Create teams	❌	❌	❌	❌	✅
Re-name teams	❌	❌	❌	❌	✅
Add/remove team members	❌	❌	❌	❌	✅
Remove teams	❌	❌	❌	❌	✅

Workspace administration#

	Viewer	Launcher	Editor	Admin	Organization Admin
Manage alerts	❌	❌	✅	✅	✅
Edit workspace	❌	❌	✅	✅	✅
Administer SAML	❌	❌	❌	❌	✅
Manage SCIM	❌	❌	❌	❌	✅
View usage	❌	❌	❌	❌	✅
Manage billing	❌	❌	❌	❌	✅

You are viewing an outdated version of the documentation.

Understanding role-based access control in Dagster Cloud#

Dagster Cloud user roles#

User role enforcement#

Teams#

Assigning user and team roles#

Applying role overrides#

Code locations#

Team members#

Viewing overrides#

Removing overrides#

User permissions reference#

General#

Deployments#

Code locations#

Agent tokens#

User tokens#

Users#

Teams#

Workspace administration#

Related#