Default policies

Default IAM policies

Thalassa Cloud ships a set of built-in policies for access control. Each policy defines which API resources a principal may access and which actions they may perform. The same policies are available as organisation roles and as system IAM policies inside projects.

For how API requests evaluate these permissions, see API authorization.

Policy naming

Built-in policies follow a <service>:<Access> naming pattern:

Pattern	Meaning	Examples
`<service>:ReadAccess`	Read and list only	`iam:ReadAccess`, `dns:ReadAccess`, `kms:ReadAccess`
`<service>:FullAccess`	Full CRUD on that service’s resources	`dns:FullAccess`, `secrets:FullAccess`, `kms:FullAccess`
`<service>:<Action>`	A single cryptographic or operational action	`kms:Encrypt`, `kms:Decrypt`, `kms:Rotate`

The service prefix identifies the product area (iam, k8s, iaas, dns, kms, secrets, dbaas, and others). The Access suffix describes the permission level or action.

Older built-in policies may still use legacy names (for example k8s-admin, iaas-devops, or FullAdminAccess instead of FullAccess). These are being aligned to the <service>:<Access> convention over time.

Custom policies you create must not use a system: prefix. Use your own descriptive names.

How defaults work

Default policies are platform-managed. They are marked read-only and cannot be renamed, deleted, or have their rules changed.
The platform keeps defaults in sync with the templates defined in the product. New policies may be added over time; existing rules may be updated to match new services.
The organisation owner is automatically bound to the admin:all policy as an organisation role.
You can create custom IAM policies and custom organisation roles alongside the defaults.

Permission types

Policies grant one or more of the following actions on each resource type:

Permission	Meaning
`create`	Create new resources
`read`	Read a single resource
`list`	List or search resources
`update`	Modify existing resources
`delete`	Delete or disable resources
`*`	All standard actions on the matched resources
`push` / `pull`	Push to or pull from a container registry
`encrypt` / `decrypt`	Encrypt or decrypt data with a KMS key
`sign` / `verify`	Sign or verify data with a KMS key
`hmac` / `verify-hmac`	Generate or verify an HMAC with a KMS key
`rotate` / `export`	Rotate or export a KMS key
`getSecretValue` / `putSecretValue`	Read or write secret payload data

When a rule lists specific resource types with an empty resource-identity list, it applies to all instances of those types in scope.

Global policies

These policies span the entire platform API surface.

Policy name	Permissions	Description
`admin:all`	All actions on all resources (`*`)	Full administrative access. Assigned automatically to the organisation owner.
`user:FullAccess`	`*` on workload resources	Build and operate product workloads without organisation IAM, membership, or billing administration. Closest equivalent to AWS PowerUserAccess.
`user:read`	`read`, `list` on all resources	Read-only access across the organisation or project.

user:FullAccess includes Kubernetes, IaaS (including SSH keys, shared filesystems, and quick launch), DBaaS, container registry, object storage, DNS, KMS, Secrets Manager, Terraform state, observability, service accounts, cloud-init templates, and access-elevation requests. It does not grant organisation role/policy binding administration, member invites, OIDC/federated identity provider admin, or billing resources (invoices, mandates, credits, budgets, contracts).

Organisation management

Policy name	Permissions	Resources
`org:admin`	Full CRUD	Organisation settings, members, invites, roles, quotas, teams, notifications, billing (invoices, credits, budgets, savings plans, contracts), addresses, SSH keys, service accounts, federated identities, OIDC clients, audit logs, personal access tokens, access credentials, cloud-init templates, projects
`org:auditor`	`read`, `list`	Same organisation resources as `org:admin` (excluding write-only financial actions such as mandate management)
`org:financial`	All actions (`*`)	Organisation profile, quotas, notifications, addresses, invoices, contracts, mandates, credits, budgets, savings plans

Identity and access management

Policy name	Permissions	Resources
`iam:ReadAccess`	`read`, `list`	Organisation roles, role permissions, role bindings, service accounts, service-account credentials, federated identities, identity providers, audit logs, projects, IAM policies/bindings/permissions
`iam:FullAccess`	Full CRUD	Same as `iam:ReadAccess`, plus organisation cloud-init templates; can `review` access elevation requests
`iam:AccessElevation:request`	`create`	Access elevation requests
`iam:AccessElevation:review`	`read`, `list`, `review`	Access elevation requests

Kubernetes

Policy name	Permissions	Resources
`k8s:admin`	Full CRUD	Clusters, node pools, machines, version streams, versions, API proxy, kubeconfig download & sessions, cluster roles, bindings, and permissions
`kubernetes:AdminClusterAccess`	Full CRUD on clusters, node pools, machines, API proxy; `read`/`list` on cluster roles; kubeconfig download	Operational cluster management without full role-administration write access
`kubernetes:AllowKubeConfigDownload`	`read`, `list`, `create` on kubeconfig download & API proxy; `read`, `list` on kubeconfig sessions	Download cluster credentials only
`k8s:developer`	`create`, `read`, `update`, `list` (no `delete`) on clusters/node pools/machines; kubeconfig download; catalogue reads	Day-to-day cluster operations without tear-down rights
`k8s:auditor`	`read`, `list`	All Kubernetes resources
`k8s:ReadAccess`	`read`, `list`	All Kubernetes resources
`k8s:FullAccess`	Full CRUD	All Kubernetes resources

Infrastructure (IaaS)

Policy name	Permissions	Resources
`iaas:admin`	Full CRUD; registry includes `push`/`pull`	Cloud regions, VPCs, subnets, routes, peering, VPN/NAT gateways, load balancers, VMs, volumes, snapshots, security groups, machine images/types, SSH keys, shared filesystems, quick launch, cloud-init, TFS, and container registry
`iaas:devops`	Full CRUD on compute & networking; registry includes `push`/`pull`	VPCs, endpoints, firewall rules, routes, subnets, NAT gateways, reserved IPs, load balancers, VMs, volumes, security groups, snapshots, SSH keys, shared filesystems, quick launch, cloud-init, container registry
`iaas:developer`	`create`, `read`, `update`, `list` (no `delete`) on compute workflow resources; catalogue `read`/`list`	VMs, volumes, attachments, security groups, SSH keys; plus read-only VPC/subnet/image/machine-type/region/reserved IP/cloud-init/quick launch
`iaas:auditor`	`read`, `list`; registry `pull`	Full IaaS resource set (including SSH keys, shared filesystems, quick launch) and container registry
`iaas:ReadAccess`	`read`, `list`	Full IaaS resource set including SSH keys, shared filesystems, quick launch, and cloud-init (excluding TFS and container registry)
`iaas:FullAccess`	Full CRUD	Full IaaS resource set including SSH keys, shared filesystems, quick launch, and cloud-init (excluding TFS and container registry)

Terraform state (TFS)

Policy name	Permissions	Resources
`tfs:ReadAccess`	`read`, `list`	Terraform state backends
`tfs:FullAccess`	Full CRUD	Terraform state backends

Container registry

Policy name	Permissions	Resources
`registry:admin`	Full CRUD + `push`/`pull`	Registries, namespaces, namespace configuration, repositories
`registry:developer`	`read`, `list`, `push`, `pull`	Registries, namespaces, configuration, repositories
`registry:viewer`	`read`, `list`, `pull`	Registries, namespaces, configuration, repositories
`registry:ReadAccess`	`read`, `list`, `pull`	Registries, namespaces, configuration, repositories
`registry:FullAccess`	Full CRUD + `push`/`pull`	Registries, namespaces, configuration, repositories

Database as a service (DBaaS)

Policy name	Permissions	Resources
`dbaas:admin`	Full CRUD on DB resources; `read`/`list` on VPC, subnet, machine types, and volume types	DB clusters, backup schedules, backups, instance types, object stores
`dbaas:devops`	Full CRUD on DB resources; `read`/`list` on VPC, subnet, machine types, and volume types	DB clusters, backup schedules, backups, object stores
`dbaas:auditor`	`read`, `list` on DB and dependency catalogue resources	DB clusters, backup schedules, backups, instance types; VPC/subnet/machine types/volume types
`dbaas:ReadAccess`	`read`, `list`	DB object stores, clusters, backups, instance types; VPC, subnet, machine types, and volume types
`dbaas:FullAccess`	Full CRUD on DB resources; `read`/`list` on dependency catalogue	DB object stores, clusters, backups, instance types; VPC, subnet, machine types, and volume types
`dbaas:DbaasManager`	Full CRUD on DB resources; `read`/`list` on VPC, subnet, machine types, and volume types	Intended for the Thalassa DBaaS Manager Controller service account

DBaaS instance-type listing uses the IaaS cloud_machine_type permission. Volume-type listing uses cloud_persistent_volume list. Write roles therefore include those catalogue reads so cluster create workflows succeed without admin:all.

Object storage

Policy name	Permissions	Resources
`storage:admin`	Full CRUD	Object storage buckets
`storage:developer`	`create`, `read`, `update`, `list`	Object storage buckets
`storage:auditor`	`read`, `list`	Object storage buckets
`objectstorage:ReadAccess`	`read`, `list`	Object storage buckets
`objectstorage:FullAccess`	Full CRUD	Object storage buckets

Key management (KMS)

Policy name	Permissions	Resources
`kms:ReadAccess`	`read`, `list`	KMS keys
`kms:FullAccess`	Full CRUD	KMS keys
`kms:Encrypt`	`encrypt`	KMS keys
`kms:Decrypt`	`decrypt`	KMS keys
`kms:Sign`	`sign`	KMS keys
`kms:Verify`	`verify`	KMS keys
`kms:HMAC`	`hmac`	KMS keys
`kms:VerifyHMAC`	`verify-hmac`	KMS keys
`kms:Rotate`	`rotate`	KMS keys
`kms:Export`	`export`	KMS keys

KMS roles require the kms feature gate on your organisation.

Secrets Manager

Policy name	Permissions	Resources
`secrets:ReadAccess`	`read`, `list`	Secret metadata and versions
`secrets:FullAccess`	Full CRUD + `getSecretValue`, `putSecretValue`	Secrets at allowed paths

DNS

Policy name	Permissions	Resources
`dns:ReadAccess`	`read`, `list`	DNS zones and records
`dns:FullAccess`	Full CRUD	DNS zones and records

Observability (workspaces)

Control-plane policies for managing observability workspaces (/v1/observability/workspaces).

Policy name	Permissions	Resources
`observability:WorkspaceReadOnlyAccess`	`read`, `list`	Observability workspaces
`observability:WorkspaceFullAccess`	Full CRUD	Observability workspaces

Observability (Prometheus)

Prometheus data-plane policies gate gateway ingest, query, Alertmanager, and ruler APIs (scoped per workspace identity).

Policy name	Permissions	Resources
`prometheus:FullAccess`	Full CRUD	Remote write, query, Alertmanager, ruler
`prometheus:ReadOnlyAccess`	`read`, `list`	Remote write, query, Alertmanager, ruler
`prometheus:RemoteWriteFullAccess`	Full CRUD	Remote write API
`prometheus:QueryFullAccess`	Full CRUD	Query API
`prometheus:QueryReadOnlyAccess`	`read`, `list`	Query API
`prometheus:AlertmanagerFullAccess`	Full CRUD	Alertmanager
`prometheus:AlertmanagerReadOnlyAccess`	`read`, `list`	Alertmanager
`prometheus:RulerFullAccess`	Full CRUD	Recording and alerting rules
`prometheus:RulerReadOnlyAccess`	`read`, `list`	Recording and alerting rules

Observability (Loki)

Loki data-plane policies gate gateway push, query, and delete APIs (scoped per workspace identity).

Policy name	Permissions	Resources
`loki:FullAccess`	Full CRUD	Push, query, delete
`loki:ReadOnlyAccess`	`read`, `list`	Push, query, delete
`loki:PushFullAccess`	Full CRUD	Push API
`loki:QueryFullAccess`	Full CRUD	Query API
`loki:QueryReadOnlyAccess`	`read`, `list`	Query API
`loki:DeleteFullAccess`	Full CRUD	Delete API
`loki:DeleteReadOnlyAccess`	`read`, `list`	Delete API