IAM at tenant level
What is IAM describes the model your customers see: permissions granted at customer or VDC level. As the operator of the platform you sit above that, and there are two extra scopes plus one rule that is easy to get wrong.
The full hierarchy
PLATFORM › TENANT › CUSTOMER › VDC
| Scope | What it covers | Needs a target |
|---|---|---|
| Platform | The whole platform, across every tenant. Reserved for EdgeX staff. | No |
| Tenant | Your organization as a provider: your team, your customers, contracts and billing. | No |
| Customer | One customer, and every VDC belonging to it. | Yes |
| VDC | One virtual datacenter. | Yes |
Your customers never see the platform and tenant levels. From inside a customer, that customer is the top of the world.
This is the one that surprises people. To act on a resource that lives in a VDC, such as a machine, a disk, a firewall rule or a backup, the permission has to be granted on that VDC or on the customer that owns it. A grant at tenant scope is not enough, even though tenant sits higher in the hierarchy.
Tenant scope is for running the tenant: inviting people, managing groups, customers and contracts. Someone who also has to operate infrastructure needs a second assignment, further down.
The reason is deliberate. Tenant scope is the support and administration level, and letting it silently reach into every customer's infrastructure would mean an administrator operating machines that never appear on their own screen.
Assigning across customers
A group assigned at customer level descends to all VDCs of that customer, through the contract that links them. This is the normal way to give your support team access to a customer's environment: assign at the customer, not at the tenant.
Default groups
Only two groups are created for a new tenant, CUSTOMER-ADMIN and VDC-OPERATOR, both described in What is IAM. Platform level has its own group, PLATFORM-ADMIN, which carries the super administrator key and belongs to EdgeX staff.
If your team needs a tenant-wide role, create a group at tenant scope with the permissions it actually needs, remembering the rule above: infrastructure permissions in it will not apply inside VDCs.