Skip to content

Commit 61fb55c

Browse files
RayOffiahsarahlwelton
authored andcommitted
[DOC-11988 7.6] RBAC role change impact to eventing function (#263)
* [DOC-11988-7.6]: RBAC role change impact to eventing function Added reference to warning. * [DOC-11988-7.6]: RBAC role change impact to eventing function Tidying up some of the grammar. Minor spelling fixes.
1 parent 984f4c2 commit 61fb55c

File tree

1 file changed

+6
-4
lines changed

1 file changed

+6
-4
lines changed

modules/eventing/pages/eventing-rbac.adoc

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@
77
[#description]
88
== Description: What is RBAC
99

10-
Couchbase provides _Role-Based Access Control_ (RBAC), in which access privileges are assigned to fixed roles; which are in turn assigned to users (each of which may be an administrator or an application) either _directly_; or _indirectly_, by means of _user-groups_.
10+
Couchbase provides _Role-Based Access Control_ (RBAC), in which access privileges are assigned to fixed roles, which are in turn assigned to users, (each of which may be an administrator or an application) either _directly_; or _indirectly_, by means of _user-groups_.
1111

1212
Couchbase Server Enterprise Edition provides RBAC with multiple roles for finer access control.
13-
Community Edition provides multiple users that can be assigned to limited set of roles.
13+
Community Edition provides multiple users that can be assigned to a limited set of roles.
1414
There are three fixed roles in the community edition of Couchbase providing coarser access control: Bucket Full Access (`bucket_full_access[*]`), Admin (`admin`), and Read Only Admin (`ro_admin`).
1515

1616
A Couchbase-Server _role_ permits one or more _resources_ to be accessed according to defined _privileges_.
@@ -27,9 +27,11 @@ For more information, see xref:learn:security/authorization-overview.adoc[Author
2727
A bucket.scope combination is used for identifying functions belonging to the same group.
2828

2929
Only the "Eventing Full Admin" role and also the "Full Admin" role can set the bucket.scope to *+*+.+*+*; all other Eventing non-privileged users need to define a *Function Scope* for their Eventing functions that references an existing resource of bucket.scope.
30-
This provides role based isolation of Eventing functions between non-privileged users
30+
This provides role-based isolation of Eventing functions between non-privileged users
3131

32-
Typically you should set Function Scope to the bucket.scope that holds the collection that is the source of your mutations to your Eventing Function. This best practice ensures that you _do not_ inadvertently cause an Eventing Function to undeploy by removing a *Function Scope* pointing to a resource that is not required for the function to run.
32+
include::cloud:eventing:partial$rbac-warning.adoc[]
33+
34+
Typically, you should set Function Scope to the bucket.scope that holds the collection that is the source of your mutations to your Eventing Function. This best practice ensures that you _do not_ inadvertently cause an Eventing Function to undeploy by removing a *Function Scope* pointing to a resource that is not required for the function to run.
3335

3436
NOTE: A user can be assigned multiple "Eventing/Manage Scope Function" RBAC roles.
3537
If any of these roles match an existing Eventing Function's *Function Scope*, then that user can manage, modify, or delete the Eventing Function even if it was created or imported by someone else.

0 commit comments

Comments
 (0)