To better protect your data pipelines and cloud infrastructure, Astro provides role-based access control (RBAC) for Organizations and Workspaces. Each Astro user has a Workspace role in each Workspace they belong to, plus a single Organization role. Users can also belong to Teams, which apply the same Workspace role to a group of users. RBAC is also available for Deployments through Deployment Admin and custom Deployment roles. For Deployments running Astro Runtime 3.1-12 or later, Dag-level roles provide fine-grained access control for individual Dags within a Deployment. See Dag-level access control.
You can also apply roles to API tokens to limit the scope of their actions in CI/CD and automation pipelines. See Manage Deployments as code.
Astro has hierarchical RBAC. Within a given Workspace or Organization, senior roles have their own permissions in addition to the permissions granted to lower roles. For example, a user or API token with Organization Owner permissions inherits Organization Billing Admin and Organization Member permissions because those roles are lower in the hierarchy.
The Astro role hierarchies in order of inheritance are:
Additionally, Organization Owners inherit Workspace Owner permissions for all Workspaces in the Organization.
An Organization role grants a user or API token some level of access to an Astro Organization. The Organization Owner role includes access to all of the Workspaces within that Organization. All users have at least an Organization Member role regardless of whether they belong to a Workspace, however, an API token’s access is based on the scope you define for it. For example, you must give an API token an organization owner role to perform Organization-level actions or to access the list of all Workspaces in the Organization.
Developer plans are limited to two non Organization Owner users. See pricing.
The following table lists the available Organization roles:
To manage users in an Organization, see Manage Organization users. To manage the Organization permissions of your API tokens, see Organization API tokens.
Enhanced Support Access is enabled by default for all Organizations to ensure faster, more effective assistance from the Astronomer support team. It grants read-only Admin access to your Organization’s details, allowing the support team to troubleshoot issues in real time and provide premium-level support. Support does not have access to make any changes to your environment.
You can view any activity by the Astronomer support team by viewing your Organization’s Audit Logs.
If you have IP Access List enabled, Astronomer support with Enhanced Support Access can still view your Organization’s details.
You can disable this feature at any time by going to the General Settings page in your Organization Settings page. Click Edit Details and change the Enhanced Support Access from Allowed to Disallowed.
A Workspace role grants a user or API token some level of access to a specific Workspace. If a user or API token has some level of access to a Workspace, that access applies to all Deployments in the Workspace.
To manage a user’s Workspace permissions, see Manage Workspace users.
There are two types of Deployment roles: the default Deployment Admin role and custom Deployment roles.
Deployment Admin roles have the same permissions as the Workspace Operator role but only Deployment-level operations in a specific Deployment. For example, a Deployment Admin can create a Deployment environment variable but, unlike a Workspace Operator, they can’t create an Astro alert because alerts are configured at the Workspace level.
A custom Deployment role is a role that your Organization has configured to have specific Deployment-level permissions. For a complete list of available custom Deployment role permissions, see Custom role permissions reference.
Dag roles provide per-Dag access control within a Deployment. Unlike Deployment roles, which apply to all Dags in a Deployment, Dag roles are scoped to specific Dags by tag or Dag ID. Astronomer recommends binding roles using Dag tags so that new Dags with matching tags are automatically covered. There are two default Dag roles:
You can also create custom Dag roles with granular permissions. For complete setup instructions, see Dag-level access control. For a list of available custom Dag role permissions, see Custom role permissions reference.
A Deployment Admin has permissions equivalent to a Workspace Operator, but scoped to a specific Deployment rather than the entire Workspace. A user can be a Deployment Admin for multiple Deployments.
Because Deployment Admin permissions apply only within the assigned Deployment, a Deployment Admin can’t perform Workspace-level actions such as creating Astro alerts, managing Workspace API tokens, inviting users, or using the Astro Environment Manager.
Within their assigned Deployment, a Deployment Admin can:
There are two ways to define a user’s role in a Workspace:
If a user has permissions to a Workspace both as an individual and as a member of a Team, then Astronomer recognizes the more privileged role.
For example, if a user belongs to a Workspace as a Workspace Member, but also belongs to a Team in the Workspace with Workspace Owner privileges, then the user has Workspace Owner privileges in the Workspace.