Managed services with VDC roles

To provide managed services, such as read only access to resources in a public cloud provider, you can use virtual datacenter roles. Virtual datacenters (VDCs) contain user resources, in AWS they are VPCs, in Azure, they are Virtual networks. Roles are the set of privileges assigned to a user.

So for example, you can give users full access to VDCs in private cloud and read only access to VDCs in public cloud. By default users have full access to work in all of their virtual datacenters on the platform. A VDC role replaces the user’s role within one or more virtual datacenters.

The administrator can set a default VDC role for a tenant in a provider, or a region, and they can update specific virtual datacenters with custom roles. For example, AWS virtual datacenters could always be read only, if the administrator sets a VIEWER role to replace a USER role.

The role restriction applies to cloud users only, not administrators, and it is also possible to create exceptions for specific users.

See Set a VDC role to limit user access and Set a default role to limit tenant access to VDCs in a provider or location.