Allow viewing user and host directory configuration.
Allow creating and modifying user and host directories, bringing new users and hosts to PrivX.
Allow viewing existing roles and role configurations.
Allow creating and modifying roles. NOTE: this will give permissions to grant roles to any user, so granting this permission will be effectively the same as granting superuser permissions.
Allow viewing existing workflows and permissions.
Allow creating and modifying workflows. NOTE: this can be used for granting approval access to restricted roles. Use carefully.
Allow creating role approval requests via workflows.
Allow creating role approval request on behalf of other user. For example, manager can ask more permissions on behalf of employee.
Allow viewing existing users.
Allow modifying existing local users. Does not apply to users from third party user directories, like AD.
Allow viewing existing hosts for the access group defined for the role.
Allow modifying existing hosts' configuration for the access group defined for the role.
Allow creating global secrets. Allow granting read/write access to user's own personal secrets to others.
Allow creating and modifying existing global and personal vault secrets.
Allow API clients to fetch SSH access credentials from the Authorizer.
Enable connection monitoring view, show the connection metadata. Access groups are taken into account.
Enable access role grant, revoke and listing for the connections.
Enable connection playback and playback search Access groups are taken into account.
Enable viewing connection logs. Logs reveal all user inputs some of which may not be revealed in connection playback.
Enable ongoing connection termination.
Enable manual connections.
Enable fetching access credentials from authorizer REST API. API clients require this permission to be able to fetch access credentials. PrivX users can fetch access credentials also without this permission.
Allow creating and modifying access groups.
Allow viewing audit event logs.
Allow creating and modifying cloud log collectors.
Allow viewing AWS role <-> PrivX role mappings.
Allow modifying AWS role <-> PrivX role mappings.
Allow importing and modifying current user's authorized keys for SSH Bastion login.
Allow creating and modifying API Clients for scripted access via REST API.
Allow modifying PrivX license.
Allow viewing PrivX settings
Allow viewing and modifying PrivX settings
Updated 7 months ago