New project-level roles

Aiven has added three project-level roles so you can grant access with least privilege: project admin, project manager, and project read access.

Project manager

The project manager (role:project:manager) is for day-to-day project operations. This role can view and manage services, their configuration, and key project configuration like permissions and integrations. It replaces the operator role and has fewer permissions, making it a more secure choice for granting least privilege access.

Project admin

The project admin (role:project:admin) role replaces the legacy admin role. Users with this role can manage project permissions, tags, settings, integrations, networking, and all services in the project.

Project read access

The project read access role (role:project:read) is for users who need visibility, but don’t need to make changes. It replaces the read_only role, and can view project permissions, tags, event logs, integrations, and networking. It also has read access to services, including logs, metrics, and service users. Service configuration secrets and service user passwords are redacted.

Use these new permissions for new assignments. The legacy operator, admin, and read_only roles will be deprecated and removed. A separate announcement will be made for the deprecation of those roles.

For more information, see Aiven’s documentation on roles and permissions.