Role-Based Access and Security Tiers
Access to ClickHouse data hosted in Altinity.Cloud is controlled through a combination of security tiers and account roles. This allows companies to tailor access to data in a way that maximizes security while still allowing ease of access.
Altinity.Cloud groups a set of clusters together in ways that allow companies to provide Accounts access only to the clusters or groups of clusters that they need.
Altinity.Cloud groups clusters into the following security-related tiers:
Figure 1 - Security tier showing the relationship between an organization, environment, cluster, and ClickHouse database nodes.
- ClickHouse databases and tables live inside clusters.
- Clusters contain ClickHouse databases and manage access.
- Environments contain one or more clusters.
- Organization is the highest level that houses one or more environments.
Account access is controlled by assigning an account a single role and a security tier depending on their role.
A single account can be assigned to:
- A single Organization
- One or multiple Environments
- One or multiple Clusters within an environment
The actions that can be taken by Altinity.Cloud accounts are based on the role they are assigned.
The following roles and their actions based on the security tier are detailed in Table 1.
- orgadmin manages the Organization, including all user accounts and Environment settings, and has full access to any cluster.
- envadmin is a member of an Organization and can edit assigned Environments and has full access to any cluster.
- envuser is a member of an Organization and has full access to specified clusters.
- envsupport is a member of an Organization and has read access to specified environments and clusters.
- grafanauser is a member of an Organization and has read access to specified environments.
- billing can access the billing page only. From there they can view invoices and update payment details.
Table 1 - Role names and their levels of access to Environments and Clusters.
The following example in Table 2 shows an Organization called HappyDragon that shows how Accounts and Role assignments are configured. Role names are also shown in Figure 1. The account roles are tied into the security tiers and allow an account to access multiple environments and clusters depending on what type of tier they are assigned to.
|mary||Administrator||orgadmin||HappyDragon||all||all||Access to all Env.||all|
Table 2 - Accounts and their roles and security tiers.
Account and Roles
Mary (Administrator, Role: orgadmin)
Mary is the orgadmin role, which has the highest level of access in this example.
- Has full access to the organization account
- Can create and manage access for other users
- Can create and manage new environments
- Can create and manage new clusters
Jessica (Operations, Role: envadmin)
- Has read access (but not write or delete access) to both Dev and Prod environments
- Has full access to read, write and delete clusters in both environments
Peter (Developer, Role: envadmin)
- Has read access (but not write or delete access) to the Dev environment
- Has full access to read, write and delete any cluster in the Dev environment
Paul (Marketing user, Role: envuser)
- Has read, write and delete access to the cluster marketing in the environment HappyDragon_Prod