Custom Roles
Create your own custom role types for greater control of permissions assigned to users at the Workplace and Project level.
Custom roles allow you to create more fine-grained permission assignments than the default Workplace and Project roles supplied by Doppler so you can better apply the principle of least privilege.
When combined with User Groups and SCIM for automated user provisioning, users can be automatically assigned custom roles at the project and workplace level based on group membership.
Requires an upgraded subscription
This feature is standard on our Enterprise plan or can be added on to an existing Team plan. Explore pricing or book a demo for more details.
Prerequisites
- Enterprise subscription with Custom Roles enabled
- Must be a workplace owner
Management
Custom Roles are created and managed by navigating to the Doppler dashboard under Team -> Roles.
Roles can be assigned at the Workplace and Project level:
- Workplace: Each user can be assigned a single Workplace role (groups cannot currently be assigned a Workplace role). These roles include permissions for accessing logs, team management, settings, billing, etc. You can see a full list of permissions below.
- Project: Each user or group can be assigned one Project role per project. If you need different permissions on a per-config basis, you can assign separate permission levels to different groups and assign the users into these various groups. The permissions granted to the user are the highest available from the combination of all roles they have applied to them. These roles include permissions for secrets read/write, project management, project access, config management, etc. You can see a full list of permissions below.
Assignment
Custom roles are assigned in the same way Doppler's pre-defined roles are.
Default
The default workplace role is assigned when a new user joins a workplace if the user's role is undefined (e.g. if user groups are not used)
Workplace Level
Navigate to the dashboard Team page and click on the Users tab to assign a specific role to user:
Project Level
Navigate to Members in the Project sub-menu menu to assign permissions at the Project level.
Available Permissions
Below is a breakdown of all the available permissions for Workplace and Project roles.
Workplace
| Name | Category | Description |
|---|---|---|
| Access All Projects | Project Access | Automatically adds the user as a member on all projects in the workplace. |
| Admin on All Projects | Project Access | Automatically gives the user Admin level permissions on all projects in the workplace. Admins on a project have the ability to manage that project's environments, user memberships, and webhooks. They can also enable/disable project-level secret referencing, access all environments/configs, rename the project, and delete the project. |
| Create Project | Project Management | Allows the user to create new projects in the workplace. |
| Manage Secrets Referencing | Project Management | Allows the user to enable or disable secret referencing on the workplace level (i.e., enable or disable it for ALL projects). |
| View Default Environments | Project Management | Allows the user to view the Default Environments for the workplace. |
| Manage Default Environments | Project Management | Allows the user to modify the Default Environments for the workplace. |
| View Logs | Activity Logs | Allows the user to view only the workplace Activity Logs the user has access to. |
| View All Logs | Activity Logs | Allows the user to view ALL workplace Activity Logs. |
| View Team | Team Management | Allows the user to view the Team settings page – including read access to the Users, Groups, and Roles tabs. |
| Manage Team * | Team Management | Allows the user to make changes to the Team settings – including inviting users, creating/modifying groups, and assigning users to groups. It also provides access to the SSO tab and allows the user to configure the workplace's SSO settings. Enabling this permission automatically enables the View Settings and List Verified Domains permissions as they're required. |
| Manage Custom Roles * | Team Management | Allows the user to create or modify Custom Roles from the Roles tab on the Team settings page. |
| View Service Accounts | Service Accounts | Allows the user to view Service Accounts on the Team settings page, including the projects they have access to. |
| Manage Service Accounts | Service Accounts | Allows the user to create or modify Service Accounts on the Team settings page. |
| View Service Account API Tokens | Service Accounts | Allows the user to view a list of all existing Service Accounts API Tokens. This allows them to see a preview of the token value, but not the full value. |
| Manage Service Account API Tokens | Service Accounts | Allows the user to create or modify Service Account API Tokens. This includes the ability to roll an existing API token (which would then provide access to the new token value). |
| View Billing | Billing Management | Allows the user to access the Billing settings page and view the current plan the workplace is on. |
| Manage Billing | Billing Management | Allows the user to view and modify the workplace plan and payment method on the Billing settings page. |
| View Settings | Settings Management | Allows the user to access the workplace Settings page and view the current |
| Manage Settings | Settings Management | Allows the user to delete the workplace and modify the workplace Settings – including the ability to rename the workplace, update contact emails, and add or update Logging Services. |
| List Verified Domains | Settings Management | Allows the user to view the workplace's Verified Domains on the workplace Settings page. |
| Manage Verified Domains | Settings Management | Allows the user to add or modify the workplace's Verified Domains on the workplace Settings page. |
| Use Integrations | Integration Connections | Allows the user to create syncs using existing Integration connections that have already been created and configured. |
| View All Integrations | Integration Connections | Allows the user to view all the existing Integration connections from the workplace Settings page. |
| Manage Integrations | Integration Connections | Allows the user to create Integration connections from the sync creation page and modify existing Integration connections from the workplace Settings page. |
| Manage EKM | Token Engine (EKM) | Allows the user to configure the workplace's Enterprise Key Management (EKM) settings. |
* Actors with this permission can change all permissions including their own.
Project
| Name | Category | Description |
|---|---|---|
| Rename Project | Project | Allows the user to rename the project. |
| Delete Project | Project | Allows the user to delete the project. |
| Manage Project Members | Project Access | Allows the user to add/remove users and groups to a project along with setting their permission level and which configs are accessible. |
| Access All Configs | Project Access | Allows the user to access all configs on the project. Used primarily to ensure a user will always have access to new configs added to the project over time. |
| List All Environments | Project Access | Allows the user to view all Environments on the main project config page. |
| List All Configs | Project Access | Allows the user to view all Configs in the Environments they have access to on the main project config page. |
| Manage Notes | Project Tools | Allows the user to create and modify Notes on secrets they have access to. |
| Manage Project Webhooks | Project Tools | Allows the user to create and modify Webhooks on the project. |
| Manage Reminders | Project Tools | Allows the user to create and modify Reminders on secrets they have access to. |
| Manage Project Secrets Referencing | Project Tools | Allows the user to enable or disable Secret Referencing for the project. |
| Create Environments | Environments | Allows the user to create new Environments for the project. |
| Delete Environments | Environments | Allows the user to delete Environments for the project. |
| Reorder Environments | Environments | Allows the user to change the order of Environments on the main project config page. Note that this only impacts the order they're displayed in on the dashboard. |
| Rename Environments | Environments | Allows the user to rename Environments. |
| Manage Environment Settings | Environments | Allows the user to enable or disable Personal Configs for Environments they have access to. |
| Create Config | Config | Allows the user to create Configs in Environments they have access to. |
| Delete Config | Config | Allows the user to delete Configs in Environments they have access to. |
| Duplicate Config | Config | Allows the user to duplicate Configs in Environments they have access to. |
| Rename Config | Config | Allows the user to rename Configs in the Environments they have access to. |
| Lock Config | Config | Allows the user to lock and unlock Configs in the Environments they have access to. Locking a Config prevents it from being renamed or deleted until unlocked. |
| Manage Service Tokens | Config Tools | Allows the user to create, roll, and delete service tokens for Configs in the project. |
| Manage Trusted IPs | Config Tools | Allows the user to add, remove, and update Trusted IPs for Configs they have access to. |
| Manage Config Secrets Referencing | Config Tools | Allows the user to enable or disable Secret Referencing at the Config level for any Configs they have access to. |
| View Config Logs | Config Logs | Allows the user to view the Activity Log for a Config. |
| Rollback Change | Config Logs | Allows the user to rollback a secret change from the Activity Log for a Config they have access to. |
| View Config Access Logs | Access Logs | Allows the user to view the Access Logs for Configs they have access to. |
| View Secrets | Secrets | Allows the user to view Secrets in the Configs they have access to. |
| Manage Secrets | Secrets | Allows the user to create, modify or delete Secrets in Configs they have access to. |
| Approve Change Requests | Change Requests | Allows the user to review Change Requests to approve them. |
| Lease Dynamic Secrets | Dynamic Secrets | Allows the user to lease a Dynamic Secret when fetching secrets from a Config that contains them. |
| View Dynamic Secrets | Dynamic Secrets | Allows the user to view Dynamic Secrets that have been created in Configs they have access to. |
| Manage Dynamic Secret | Dynamic Secrets | Allows the user to create, modify, or delete Dynamic Secrets for Configs they have access to. |
| View Rotated Secrets | Rotated Secrets | Allows the user to view Rotated Secrets that been created in Configs they have access to. |
| Manage Rotated Secrets | Rotated Secrets | Allows the user to create, modify, or delete Rotated Secrets for Configs they have access to. |
| Manage Syncs | Syncs | Allows the user to create, modify, or delete Syncs for Configs the project. |
Updated about 2 months ago