Skip to content

Access Management

Strawly controls what each person can see and do through a roles and permissions system. This page explains how that system works and how to manage users and roles from the web interface.

How roles and permissions work

Permissions are named access rights — for example, the ability to create users or view module data. Permissions are grouped into roles. A user can hold one or more roles. Their access is the combined set of permissions from all their roles.

Built-in roles

Strawly ships with built-in roles. These cannot be deleted, but you can create additional custom roles alongside them.

Role Access
Logs Reader Read-only access to all log types — inventory runs, metrics runs, recommendation runs, and access management audit logs.
Reader Read-only access to inventory and opportunities. Cannot change anything and cannot access the settings panel.
Settings Manager Full read/write access to the settings panel, including users, roles, credentials, and data retention.
Settings Reader Read-only access to the settings panel. Cannot create, edit, or delete anything.

Available permissions

Access

Permission What it allows
View users See the user list and individual user profiles.
Create users Create new user accounts.
Edit users Change a user's name and role assignments.
Delete users Delete user accounts.
Reset passwords Reset another user's password.
Protect users Mark or unmark a user as protected.
View roles See the roles list and their permissions.
Manage roles Create, edit, and delete roles; assign roles to users.

Modules

Permission What it allows
View modules See module data.
Enable modules Turn modules on.
Disable modules Turn modules off.

Credentials

Permission What it allows
View credentials See stored credentials. Not the actual secrets.
Manage credentials Add, edit, and delete credentials.

Database Usage

Permission What it allows
View Database Usage See the Database Usage tab and read table-by-table storage statistics. Cannot purge data.
Manage Database Usage Purge individual tables, all data, or entire categories from the Database Usage tab. Also grants View Database Usage access.

Recommendations

Permission What it allows
View Azure Recommendations See Azure cost optimization recommendations.
Manage Azure Recommendations Act on Azure recommendations — dismiss, mark implemented, or otherwise change their status. Also grants View Azure Recommendations access.

Inventory

Permission What it allows
View Inventory See the cloud resource inventory.

Logs

Permission What it allows
View Inventory Run Logs See inventory collector run history in the Logs section.
View Metrics Run Logs See metrics collector run history in the Logs section.
View Recommendations Run Logs See recommendations collector run history in the Logs section.
View Access Audit Logs See user role assignment and role permission change history in the Logs section.

Role assignment rules

Two rules apply whenever roles are assigned to a user:

  1. Manage roles is required to assign roles. A user who can create or edit other users but does not hold the Manage roles permission cannot change anyone's role assignments.
  2. You cannot grant a role whose permissions exceed your own. If you do not hold a given permission yourself, you cannot assign a role that contains it. This prevents any account from being used to create more-privileged accounts.

These rules apply to both creating a new user with roles and editing an existing user's roles.

Protected users

Any user can be marked as protected. A protected user cannot be deleted. Roles can still be assigned or removed freely regardless of the protected flag.

Strawly also enforces two system-level invariants that cannot be overridden:

  • At least one user must hold the Settings Manager role at all times.
  • At least one Settings Manager must be protected at all times.

These prevent accidental admin lockout. If an action would violate either invariant — deleting the last Settings Manager, removing the Settings Manager role from the last user who holds it, or clearing the protected flag from the last protected Settings Manager — the API rejects it with an error.

Setting or clearing the protected flag requires the Protect users permission.

Create a user

Requires: Create users. Assigning roles also requires Manage roles.

  1. Go to Settings → Access → Users.
  2. Click Invite User.
  3. Enter the user's name, email address, and a temporary password. The password must be at least 8 characters and include one uppercase letter, one number, and one special character.
  4. Optionally select one or more roles.
  5. Click Create User.

The user can log in immediately. Share the credentials with them and ask them to change their password after first login.

Edit a user

Requires: Edit users. Changing role assignments also requires Manage roles.

  1. Go to Settings → Access → Users.
  2. Open the action menu for the user (three dots) and click Rename.
  3. Update the name and confirm.

To change role assignments, open the user's action menu and select the roles option. If you hold Edit users but not Manage roles, you can rename the user but cannot change their roles.

Reset a user's password

Requires: Reset passwords.

  1. Go to Settings → Access → Users.
  2. Open the action menu for the user (three dots) and click Reset Password.
  3. Enter the new password and click Set Password.

Protect or unprotect a user

Requires: Protect users.

  1. Go to Settings → Access → Users.
  2. Open the action menu for the user (three dots).
  3. Click Protect to protect the user, or Remove Protection to remove it.

A protected user cannot be deleted. Their roles can still be changed. If the user is the last protected Settings Manager, removing protection will be rejected.

Delete a user

Requires: Delete users.

  1. Go to Settings → Access → Users.
  2. Open the action menu for the user (three dots) and click Delete.

Protected users cannot be deleted. Remove protection first.

Managing roles

You need View roles to see the roles list and Manage roles to create, edit, or delete them.

View roles and their permissions

  1. Go to Settings → Access → Roles.
  2. Click a role to see its full permission list.

Create a custom role

  1. Go to Settings → Access → Roles.
  2. Click + New Role.
  3. Enter a name and an optional description.
  4. Select the permissions this role should grant. You can only include permissions you hold yourself.
  5. Click Create.

The new role appears in the role picker when creating or editing users.

Edit a custom role

  1. Go to Settings → Access → Roles.
  2. Click the role name.
  3. Add or remove permissions, then click Save.

Changes take effect immediately. Users holding the role gain or lose the affected permissions on their next action — there is no delay and no need to log out.

Delete a custom role

  1. Go to Settings → Access → Roles.
  2. Click the role name.
  3. Click Delete and confirm.

The built-in roles cannot be deleted.