This is documentation for the next version of Grafana documentation. For the latest stable release, go to the latest version.

Documentation

Grafana documentation

Alerting

Additional configuration

Configure RBAC

Manage access using roles

Enterprise Grafana Cloud

Manage access using roles

In Grafana Enterprise and Grafana Cloud there are Basic, Fixed, and Custom roles.

Basic roles

There are four basic roles: Admin, Editor, Viewer, and None. Each basic role contains a number of fixed roles.

Details of the basic roles and the access they provide for Grafana Alerting are below.

Role	Access
Admin	Write access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), alert enrichments, and provisioning.
Editor	Write access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), alert enrichments, and provisioning.
Viewer	Read access to alert rules, notification resources (notification API, contact points, templates, time intervals, notification policies, and silences), and alert enrichments.
None	A blank canvas to assign fixed or custom roles and craft permissions more precisely. For example, if you want to give a user the ability to see alert rules, but not notification settings, add No basic role and then the fixed role Rules reader.

Fixed roles

A fixed role is a group of multiple permissions.

Fixed roles provide users more granular access to create, view, and update Alerting resources than you would have with basic roles alone.

Details of the fixed roles and the access they provide for Grafana Alerting are below.

Display name in UI / Fixed role	Permissions	Description
Silences Writer: `fixed:alerting.instances:writer`	All permissions from `fixed:alerting.instances:reader` and `alert.instances:create` `alert.instances:write` for organization scope `alert.instances.external:write` for scope `datasources:*`	Add and update silences in Grafana and external providers.
Instances and Silences Reader: `fixed:alerting.instances:reader`	`alert.instances:read` for organization scope `alert.instances.external:read` for scope `datasources:*`	Read alert instances and silences in Grafana and external providers.
Notifications Writer: `fixed:alerting.notifications:writer`	All permissions from `fixed:alerting.notifications:reader`, `fixed:alerting.receivers:writer`, `fixed:alerting.templates:writer`, `fixed:alerting.time-intervals:writer`, `fixed:alerting.routes:writer`, `fixed:alerting.inhibition-rules:writer`, `fixed:alerting.notifications.external:writer`	Add, update, and delete notification policies and contact points in Grafana and external providers.
Notifications Reader: `fixed:alerting.notifications:reader`	All permissions from `fixed:alerting.receivers:reader`, `fixed:alerting.templates:reader`, `fixed:alerting.time-intervals:reader`, `fixed:alerting.routes:reader`, `fixed:alerting.inhibition-rules:reader`, `fixed:alerting.notifications.external:reader`	Read notification policies and contact points in Grafana and external providers.
Rules Writer: `fixed:alerting.rules:writer`	All permissions from `fixed:alerting.rules:reader` and `alert.rule:create` `alert.rule:write` `alert.rule:delete` `alert.silences:create` `alert.silences:write` for scope `folders:` `alert.rules.external:write` for scope `datasources:`	Create, update, and delete all alert rules and manage rule-specific silences.
Rules Reader: `fixed:alerting.rules:reader`	`alert.rule:read`, `alert.silences:read` for scope `folders:` `alert.rules.external:read` for scope `datasources:` `alert.notifications.time-intervals:read` `alert.notifications.receivers:list`	Read all alert rules and rule-specific silences in Grafana and external providers.
Full access: `fixed:alerting:writer`	All permissions from `fixed:alerting.rules:writer` `fixed:alerting.instances:writer` `fixed:alerting.notifications:writer`	Add, update, and delete alert rules, silences, contact points, and notification policies in Grafana and external providers.
Full read-only access: `fixed:alerting:reader`	All permissions from `fixed:alerting.rules:reader` `fixed:alerting.instances:reader` `fixed:alerting.notifications:reader`	Read alert rules, alert instances, silences, contact points, and notification policies in Grafana and external providers.
Read via Provisioning API + Export Secrets: `fixed:alerting.provisioning.secrets:reader`	`alert.provisioning:read` and `alert.provisioning.secrets:read`	Read alert rules, alert instances, silences, contact points, and notification policies using the provisioning API and use export with decrypted secrets.
Access to alert rules provisioning API: `fixed:alerting.provisioning:writer`	`alert.provisioning:read` and `alert.provisioning:write`	Manage all alert rules, notification policies, contact points, templates, in the organization using the provisioning API.
Set provisioning status: `fixed:alerting.provisioning.provenance:writer`	`alert.provisioning.provenance:write`	Set provisioning rules for Alerting resources. Should be used together with other regular roles (Notifications Writer and/or Rules Writer.)
Contact Point Reader: `fixed:alerting.receivers:reader`	`alert.notifications.receivers:read` for scope `receivers:*`	Read all contact points.
Contact Point Creator: `fixed:alerting.receivers:creator`	`alert.notifications.receivers:create` `alert.notifications.receivers.test:create` for scope `receivers:uid:-`	Create a new contact point. The user is automatically granted full access to the created contact point.
Contact Point Writer: `fixed:alerting.receivers:writer`	All permissions from `fixed:alerting.receivers:creator` `alert.notifications.receivers:read`, `alert.notifications.receivers:write`, `alert.notifications.receivers:delete` and `alert.notifications.receivers.test:create` for scope `receivers:*`