Bug 1374301 - explicit required permissions for the OSP infra provider user
Summary: explicit required permissions for the OSP infra provider user
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat CloudForms Management Engine
Classification: Red Hat
Component: Documentation
Version: 5.6.0
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: GA
: 5.7.0
Assignee: Red Hat CloudForms Documentation
QA Contact: Red Hat CloudForms Documentation
URL:
Whiteboard: doc
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-08 12:13 UTC by Colin Arnott
Modified: 2018-04-04 04:42 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-04-04 04:42:34 UTC
Category: ---
Cloudforms Team: ---
Target Upstream Version:


Attachments (Terms of Use)

Description Colin Arnott 2016-09-08 12:13:08 UTC
Document URL: 
https://access.redhat.com/documentation/en/red-hat-cloudforms/4.1/managing-providers/#adding_an_openstack_infrastructure_provider

Section Number and Name: 
1.3.1.7.d

Describe the issue: 
The OSP infra provider currently requires an account with privileged access, my security standards prevent me from giving cart blanch access to my OSP undercloud environment. Can you please enumerate the permissions required by CFME so that I can use least privilege when creating the CFME user for my OSP undercloud. 

Suggestions for improvement:
Add a section indicating required permissions for the OSP infra provider.

Additional information:

Comment 2 Colin Arnott 2016-09-08 12:19:35 UTC
Sorry, I missed the section name

Section Number and Name: 
1.3.1.7.d Adding an OpenStack Infrastructure Provider: host and authentication details

Comment 4 Andrew Dahms 2018-04-04 04:42:34 UTC
Thank you for raising this bug.

After further discussion with the program team, we have been given the advice not to document specific permissions for service accounts at this time based on the following article -

http://cloudformsblog.redhat.com/2017/08/16/security-management-operations/

As such, I will be closing this bug for now, but we can re-investigate this request again in the future if required.


Note You need to log in before you can comment on or make changes to this bug.