Configure RBAC in the Control Plane

Role: A role is a list of permissions. With RBAC, permissions are attached to roles. Users assigned multiple roles receive the union of all permissions defined in those roles. Redpanda Cloud has several predefined roles that you cannot modify or delete, including Reader, Writer, and Admin. You can also create custom roles.

Account: An RBAC account is either a user account (human user) or a service account (machine or programmatic user).

Role binding: Role binding assigns a role to an account. Administrators can add, edit, or remove role bindings for a user. When you change the permissions for a given role, all users and service accounts with that role automatically get the modified permissions.

In the Redpanda Cloud Console, the Organization IAM page lists your organization’s existing users and service accounts and their associated roles. You can edit a user’s access, invite new users, and create service accounts. When you add a user, you define their permissions with role binding. Service accounts are assigned the Admin role for all resources in the organization.

On the Organization IAM - Users page, select a user to see their assigned roles. For example, for a user with Admin access on the organization, the user’s Resource is the organization name, the Scope is organization, and the Role is Admin.

Various resources can be assigned as the scope of a role. For example:

Users can have multiple roles, as long as they are each for a different resource and scope. For example, you could assign a user the Reader role on the organization, the Admin role on a specific resource group, and the Writer role on a specific cluster.

When you delete a role, Redpanda removes it from any user or service account it is attached to, and permissions are revoked.

Redpanda Cloud provides several predefined roles that you cannot modify or delete, including Reader, Writer, and Admin.

You can see all predefined roles along with their permissions on the Roles tab of Organization IAM.

In addition to the predefined roles, administrators can create custom roles to mix and match permissions for specific use cases. Custom roles let you grant only the permissions a user needs, without the broad access of predefined roles.

To create a custom role, use the Redpanda Cloud Console or the Control Plane API.

In the Redpanda Cloud Console:

After creating a custom role, you can assign it to users through role bindings on the Users tab.