Service Access Control

This guide shows you how to control who can view, change or manage each Service in SVIEW, by giving people or groups Read, Write or Admin access on that Service.

How it works

Each Service has a list of access entries. An entry pairs a subject — a person or a group — with a role. The roles build on each other: Write includes everything in Read, and Admin includes everything in Write.

Role	Lets you
Read	See the Service's applications, versions, status, costs and resources, and raise access requests for them
Write	Everything in Read, plus change application parameters and configuration
Admin	Everything in Write, plus delete applications and change their suspend schedule

A few rules apply whatever the entries say:

A Service with no entries is open to everyone in your organisation who can already see applications. Adding the first entry is what restricts it.
The Service's Technical Owner and Business Owner always have access.
Without Read, a Service's applications are hidden from the Applications list.

Prerequisites

Permission to manage Services in your organisation. This is normally held by your organisation's power users. If you do not have it, raise a request, or ask someone who does.

Steps

In SVIEW, go to Applications → Services in the sidebar and select the Service.
In the Access card, click Add new to add an entry.
Choose the Role: read, write or admin.
Enter the Subject:
- a person's email address, exactly as they sign in to SVIEW, or
- the name of a group from your identity provider.
Save the Service.

Remove an entry the same way to take access away.

Verify it worked

Ask the person to reload SVIEW. With Read, the Service's applications appear in their Applications list; with Write, they can save configuration changes; with Admin, they can delete applications and change the suspend schedule.

Common issues

The person still cannot see the Service. The subject must match their sign-in email exactly. For a group, the name must match the group your identity provider sends when they sign in.
Everyone can still see the Service. Check the entries were saved; a Service with no entries is open.
You cannot edit the access entries. You do not have permission to manage Services — raise a request.

Managing groups and roles

Custom groups and roles for your organisation are managed by CTO2B today. A self-service screen for managing your own groups and roles is in early access — raise a request if you would like to try it.

User Profile — your own roles and sign-in details
Access Requests — temporary access to namespaces, databases and the AWS Console
Set Up Your PushOps Access
Add or Remove a Team Member — onboarding a new person and removing a leaver