[VMC on AWS] Create, update, and remove roles with the MOB

Products

• VMware Cloud on AWS

Issue/Introduction

To provide the steps to create and modify roles by using the MOB.

Symptoms:
Users are unable to create, update, or remove roles through the VMware Cloud on AWS vCenter UI.

Resolution

To view all privileges: https://VMC-SDDC-ADDRESS/mob/?moid=AuthorizationManager&doPath=privilegeList
To view all roles: https://VMC-SDDC-ADDRESS/mob/?moid=AuthorizationManager&doPath=roleList
Note: The privileges and roles will be needed for the following steps.

To create a new role:

1. Open a browser and navigate to https://VMC-SDDC-ADDRESS/mob/?moid=AuthorizationManager&method=addRole
2. In the "name (required)" field, enter the role name. 
3. In the "privIds (optional)" field, enter the array of privileges needed for the role (this list can be viewed by navigating to the privileges list URL provided above). 
4. Click "Invoke Method" once all privileges have been added. 
5. If successful, the value returned is "Method Invocation Result: int". 
6. The role will be visible in the roles view link and in the vCenter UI in the "Roles" section.

To update a role:

1. Open a browser and navigate to https://VMC-SDDC-ADDRESS/mob/?moid=AuthorizationManager&method=updateRole
2. In the "roleId (required)" field, enter the value of the role needing to be updated. 
3. In the "newName (required)" field, enter the name of the role. This can be a new role name or an existing role name. When choosing an existing role name, the user will not be prompted that the role already exists. 
4. In the "privIds (optional)" field, update the array of privileges as needed. 
5. Click "Invoke Method" once all the values have been updated. 
6. If successful, the value returned is "Method Invocation Result: void". 

To remove a role:

1. Open a browser and navigate to https://VMC-SDDC-ADDRESS/mob/?moid=AuthorizationManager&method=removeRole
2. In the "roleId (required)" field, enter the value of the role needing to be removed. 
3. In the "failIfUsed (required)" field, enter "true" (without quotes). 
4. Click "Invoke Method" once the information has been entered. 
5. If successful, the value returned is "Method Invocation Result: void".

Additional Information

Impact/Risks:
When using the MOB to make changes, users will not be prompted for confirmation before making any changes, including removing roles. A custom role can not have privileges higher than the CloudGlobalAdmin role.