Role-Based Access and Security Tiers

25 April 2023 · Read time 3 min

Introduction

Access to ClickHouse data hosted in Altinity.Cloud is controlled through a combination of security tiers and account roles. This allows companies to tailor access to data in a way that maximizes security while still allowing ease of access.

Security Tiers

Altinity.Cloud groups a set of clusters together in ways that allow companies to provide Accounts access only to the clusters or groups of clusters that they need.

Altinity.Cloud groups clusters into the following security-related tiers:

Figure 1 - Security tier showing the relationship between an organization, environment, cluster, and ClickHouse database nodes.

Hierarchy

• ClickHouse databases and tables live inside clusters.
• Clusters contain ClickHouse databases and manage access.
• Environments contain one or more clusters.
• Organization is the highest level that houses one or more environments.

Security Tier

Account access is controlled by assigning an account a single role and a security tier depending on their role.
A single account can be assigned to:

• A single Organization
• One or multiple Environments
• One or multiple Clusters within an environment

Account Roles

The actions that can be taken by Altinity.Cloud accounts are based on the role they are assigned.
The following roles and their actions based on the security tier are detailed in Table 1.

Role Descriptions

• orgadmin manages the Organization including all user accounts and Environment settings.
• envadmin within an Organization can edit assigned Environments and has full access to any cluster.
• envuser is a member of an Organization that has full access to specified clusters.
• billing can access billing page only, view invoices, and update payment details.

Table 1 - Role names and their levels of access to Environments and Clusters.

Organization Example

The following example in Table 2 shows an Organization called HappyDragon that shows how Accounts and Role assignments are configured. Role names are also shown in Figure 1. The account roles are tied into the security tiers and allow an account to access multiple environments and clusters depending on what type of tier they are assigned to.

Account	Title	Role	Organization	Accounts	Billing	Environments	Clusters
mary	Administrator	orgadmin	HappyDragon	all	all	Access to all Env.	all
jessica	Operations	envadmin	HappyDragon	n/a	n/a	HappyDragon_Prod HappyDragon_Dev	all
peter	Developer	envadmin	HappyDragon	n/a	n/a	HappyDragon_Dev	all
paul	Marketing	envuser	HappyDragon	marketing	n/a	HappyDragon_Prod	marketing

Table 2 - Accounts and their roles and security tiers.

Account and Roles

Mary (Administrator, Role: orgadmin)

Mary is the orgadmin role, which has the highest level of access in this example.

• Has full access to the organization account
• Can create and manage access for other users
• Can create and manage new environments
• Can create and manage new clusters

Jessica (Operations, Role: envadmin)

• Has read access (but not write or delete access) to both Dev and Prod environments
• Has full access to read, write and delete clusters in both environments

Peter (Developer, Role: envadmin)

• Has read access (but not write or delete access) to the Dev environment
• Has full access to read, write and delete any cluster in the Dev environment

Paul (Marketing user, Role: envuser)

• Has read, write and delete access to the cluster marketing in the environment HappyDragon_Prod