Documentation is not clear about required privileges and at which level these should be applied

[greeneg]

Description

Our environment uses a least-privilege environment. When we provision, we get NoPermission errors when it tries to provision:

NoPermission: RESOURCE (vm-3962:2000), ACTION (queryAssociatedProfile): RESOURCE (vm-3962), ACTION (PolicyIDByVirtualDisk)

Current privileges:

• Datastore
  • Allocate space
  • Browse datastore
  • Low level file operations
  • Remove file
  • Update virtual machine files
  • Update virtual machine metadata
• Folder (all)
  • Create folder
  • Delete folder
  • Move folder
  • Rename folder
• Network
  • Assign network
• Resource
  • Apply recommendation
  • Assign virtual machine to resource pool
• Virtual Machine
  • Configuration (all) - for now
  • Guest Operations (all) - for now
  • Interaction (all)
  • Inventory (all)
  • Provisioning (all)

Looking for more thorough documentation on privileges required and what segments of the vCenter the privileges should be assigned under.

[tenthirtyam]

Hi @greeneg -

Are you looking for single-set documentation of privileges or per resource / data source?

Recommended: type/documentation , not type/enhancement

Ryan

[bhadrim]

@tenthirtyam Thank you for looking into this. It would be nice to have a table in a single page as documented in Required Privileges for Common Tasks table in this page

Any documentation on this is welcome as we have customers (who are very security conscious) who argue that they can create VMs on vCenter directly without certain privileges and why additional privileges are required while using Terraform providers. If we have a definitive documentation on this it would help us.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.