How permissions work in Deadline Cloud

AWS Deadline Cloud (Deadline Cloud) controls access with two systems. Access levels control what you can see and do when you sign in to the Deadline Cloud monitor or submit jobs from your workstation. AWS Identity and Access Management (IAM) policies control what AWS credentials can do, such as administering farms in the Deadline Cloud console or calling the API from a pipeline script.

When you sign in to the monitor, AWS IAM Identity Center (IAM Identity Center) authenticates you, and your access levels govern what you can do. Your requests also carry your identity, so Deadline Cloud records who created or last updated each job. IAM policies govern programmatic access, such as pipeline automation and worker hosts. You can also use IAM credentials, for example to administer farms in the Deadline Cloud console, but Deadline Cloud attributes those requests to the IAM role or user, so jobs submitted with a shared role all show the same identity.

Where you grant access levels

You grant each user or group one of four access levels: viewer, contributor, manager, and owner. Each level includes everything from the levels before it. For the exact permissions at each level, see What each access level allows at the end of this topic.

You assign access levels on farms, queues, and fleets in the Deadline Cloud console. The Deadline Cloud documentation and API call each assignment a membership. A grant on the farm applies to every queue and fleet in the farm. A grant on a queue or fleet applies only to that resource, so you can give a team the contributor level on its own queue and the viewer level everywhere else.

When a user has grants at more than one level, Deadline Cloud applies the highest one. For example, a user with the viewer level on the farm and the manager level on one queue has manager permissions on that queue and viewer permissions everywhere else in the farm. A lower-level grant can't reduce a farm-level grant.

Access levels control what you can see and manage. Access levels don't decide where jobs run: the service schedules jobs based on queue–fleet associations and each job's host requirements. For example, a grant on a fleet lets users see the fleet and its workers; it doesn't route their jobs to that fleet. To divide your farm so that permissions and hardware both land where you want them, see Organize your farms, queues, and fleets.

If you have no membership on a farm, queue, or fleet, you can't see that resource in the monitor, even though you can sign in. If your only membership is on a queue or fleet, you don't see the farm in your farm list, but you can still work with that queue or fleet. To also control who can sign in to the monitor at all, see Restricting which users can access the monitor.

How access levels relate to IAM

Access levels are enforced through IAM, but you don't write IAM policies to use them. When you sign in to the monitor, IAM Identity Center authenticates you, and the monitor makes AWS requests on your behalf using the monitor role, an IAM role in your account. The AWS managed policies attached to the monitor role allow each operation based on your access level on the farm, queue, or fleet involved. Although these requests use an IAM role, they keep your identity, so jobs still record which person created or updated them. The monitor desktop application also shares these credentials with the Deadline Cloud CLI and the integrated submitters, so the same access levels apply there.

If you sign in through the monitor, you don't need an IAM user or policies of your own. To change what an access level allows, for example to let contributors cancel their own jobs, add a policy to the monitor role. For more information, see Monitor role in the Deadline Cloud Developer Guide.

When to grant IAM permissions instead

If you use AWS credentials directly, for example in a pipeline script or in the Deadline Cloud console, your permissions come from IAM policies, and access levels don't apply. Grant IAM permissions for:

For the full IAM reference for Deadline Cloud, including supported actions, resources, and condition keys, see Identity and Access Management in Deadline Cloud.

What each access level allows

The following tables list the permissions at each access level for each resource type that a grant can be placed on, with the default AWS managed policies. A grant on a farm also confers the queue and fleet permissions on every queue and fleet in that farm. To change what a level allows, see How access levels relate to IAM. To grant an access level, see Assign permissions to users and groups.