Block the creation of raw device mapping and bus sharing disks in VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

You need to block a user from creating raw device mapping (RDM) disks and bus sharing disks in the vCenter UI, while still allowing the user to create standard SCSI disks.

Environment

VMware vCenter Server

Cause

By default, standard administrative or virtual machine management roles may include the privilege to configure raw devices. To restrict this specific action without impacting standard disk creation privileges, a custom role must be tailored to specifically omit the raw device configuration privilege.

Resolution

To resolve this issue, create and assign a custom vCenter role with the "Configure Raw device" permission removed.

Step 1: Create a test user (if needed)

1. If you do not have a test account, create a local user in vCenter by navigating to Administration > Single Sign-On > Users and Groups.
2. Alternatively, use an existing Active Directory/LDAP account that currently has no administrative permissions.

Step 2: Assign the custom role

1. Navigate to the Hosts and Clusters view.
2. Select the specific object (Datacenter, Cluster, or Folder) where you want the user to have permissions.
3. Go to the Permissions tab and click the (+) Add/Edit button.
4. User: Search for and select your test user.
5. Role: Select the Custom Role you created (ensure the Configure Raw device privilege is unchecked).
6. Propagate to children: Ensure this is checked so the permissions apply to the VMs within that object.
7. Click OK.

Step 3: Verify the restriction

1. Log out of your administrator session and log in as the test user.
2. Right-click a Virtual Machine in the inventory and select Edit Settings.
3. Click ADD NEW DEVICE.
4. Look for the Raw Device Mapping option in the list. The "RDM disk" option should now be greyed out.
5. Verify that you can still select Existing Hard Disk or New Hard Disk to confirm standard disk privileges remain intact.

Additional Information

This configuration ensures that users retain the ability to manage standard virtual disks without having the elevated permissions required to create raw device mappings or bus sharing disks.