In SkyU, Identity and Access Management (IAM) plays a crucial role in managing user permissions and access control. This section outlines the hierarchical structure of IAM roles and how they are applied across different layers within the system.

Hierarchical Structure

SkyU IAM system follows a hierarchical structure consisting of three layers:

1. Organization: The top-most layer representing the overarching entity within the system.
2. Project: Child layer under the organization, representing specific projects or initiatives within the organization.
3. Environment: Further child layer under projects, representing different environments such as development, staging, or production.

Each level has its own set of permissions that can be granted to users or groups.

Role Assignment Entities

Roles within our IAM system can be assigned to the following entities:

• Users: Individual users who interact with the system.
• Teams: Groups of users organized for collaborative purposes.
• Service Accounts: Accounts used by applications or services to interact with our system programmatically.

Role Inheritance

One of the key concepts in SkyU IAM system is role inheritance. When a role is assigned to a user, team, or service account at a higher level (e.g., organization level), that role is automatically propagated to all child layers (projects and environments) within that hierarchy. This means that permissions granted at higher levels apply globally to all entities within that hierarchy.

For example, if a user is assigned an organization-level role with certain privileges, they will have the same privileges across all projects and environments belonging to that organization.

Roles and Permissions

SkyU provides different roles that can be assigned to users or groups at each level. The roles define the permissions that the users or groups have on the resources at that level. The following roles are available in SkyU:

Custom Roles

SkyU provides an option to create custom roles at organization and project level. There the administrator can attach some restricted permissions from a given static permissions list to a user, team or a service account to give that entity only a specific access. That role also follows the above mentioned hierarchy.

Static Roles

SkyU provides some static roles that can be assigned to users or groups at each level. The roles define the permissions that the users or groups have on the resources at that level. The following roles are available in SkyU:

Organization Level

Project Level

Environment Level