HashiCorp Cloud Platform
Users
When you sign up for a HashiCorp Cloud Platform (HCP) account for the first time, the HCP Portal takes you to the create organization page to set up your organization. You can invite additional users to the organization so that they can access the resources.
This page describes how to add users to your HashiCorp Cloud Platform (HCP) account and manage their access to resources.
Invite users
Use the following procedure to invite users into your organization using email. Organization admin role is required to invite and manage users.
Note
If Single Sign-On is enabled, manage the users through the configured identity providers instead. The option to manually invite users as described in this section will not be available.
- Log into HCP Portal and choose your organization.
- Click Access Control (IAM) in the sidebar and click +Invite user.
- Enter their email address and click Add. You can repeat this step to continue adding users.
- Choose a role from the Assign role drop-down menu and click Invite. Refer to the User Permissions for information about the roles you can assign.
Resend a pending invite
To resend an invite to a specific user:
- Click Access Control (IAM) in the sidebar.
- Click Pending invites.
- Click on the dropdown of the user you want to resend an invite to and click Resend invite.
Manage users
You can remove user access or change roles from the Users screen. You must have admin permissions to invite and manage users.
- Log into HCP Portal and choose your organization.
- Click Access Control (IAM) in the sidebar.
- Click on a user name.
- You can perform the following actions:
- Click Remove to delete the user from your organization.
- Choose a new role from the Role drop-down menu.
- Click Save.
User permissions
HCP uses a role-based access controls (RBAC) system to enable members of your organizations and projects to perform actions in HCP and interact with resources. Some HCP applications allow you to assign roles for specific resources, such as an HCP Packer bucket. Refer to the specific HCP application documentation for more information.
Types of Roles
HCP has general grouping of roles on the platform: Basic (All services) roles and fine grained (service) roles.
Basic (All services) roles contain permissions from all/most services. Consider using basic roles initially when setting up and adopting HCP. However, they should be replaced with fine-grained roles when adding production workloads.
Fine grained (service) roles contain permissions from one or a minimal set of services. They are the preferred method for access management and should be leveraged over basic (All services) roles when applicable.
Inheritance
Each resource in a HCP organization has an IAM policy associated with it that informs about the level of access allowed on that resource. This IAM policy is a data structure that provides a mapping of roles to principals assigned to that resource.
Users inherit role permissions according to the following hierarchy:
- Role assigned in the organization.
- Role assigned in the project.
- Role assigned for the resource.
Permissions are inherited through the resource hierarchy. And they are effective for the resource they are assigned to and all of that resource's descendants.
For example, a user assigned the viewer
role in an organization also has viewer
role permissions for projects within the organization. Moreover, a user assigned the contributor
role in a project also has contributor
role permissions for resources within the project.
If a user has an viewer
role in an organization and admin
role on a project in the same organization, the user receives a concatenation of viewer
and admin
role permissions within that specific project.
Access Management
For more information about permissions, the different types of roles and how they can be used within HCP, checkout the Access Management page.