E2E CloudTIR Access Control FAQ
Which role should I give a new teammate?
Section titled “Which role should I give a new teammate?”The smallest one that covers their work. A Member uses the services a policy lists, a Project Lead runs a project and adds Members, a Project Manager also creates projects, and an Admin runs every project. See Roles and permissions.
Can I change or remove the Owner?
Section titled “Can I change or remove the Owner?”No. The Owner has access to every project and user, and no other role can change, reassign, or remove the Owner.
Can an Admin add another Admin?
Section titled “Can an Admin add another Admin?”No. Only the Owner can add, change, or remove Admins. See Add a user.
Does an Admin need a project role or a policy?
Section titled “Does an Admin need a project role or a policy?”No. An Admin reaches every project, so the Add user panel skips projects and policies for an Admin.
Can a person have a different role in each project?
Section titled “Can a person have a different role in each project?”Yes. A User is given each project separately, with a role in each: Project Manager, Project Lead, or Member. See Manage users in IAM.
Can a Project Lead create a project?
Section titled “Can a Project Lead create a project?”No. The Owner, an Admin, and a Project Manager can create projects. A Project Lead can change a project’s name and description. See Roles and permissions.
Why can I not change some people on the IAM page?
Section titled “Why can I not change some people on the IAM page?”Update access and Delete user appear only on people whose role is below yours, so the Owner and Admins make those changes. A Project Manager or Project Lead can change project members on the project’s Project Members tab. See Manage project members and policies.
Policies
Section titled “Policies”Does a Member need a policy?
Section titled “Does a Member need a policy?”Yes. Every Member has at least one policy, and it decides which services they can use in the project. See Policies.
Can one policy cover several projects?
Section titled “Can one policy cover several projects?”No. A policy belongs to one project. Create a policy in each project where you need one.
What can a policy allow?
Section titled “What can a policy allow?”For each service you choose, any of Read, Create, Update, and Delete. Select All Services ticks every service at once. See Create a policy.
What happens to Members when I delete their policy?
Section titled “What happens to Members when I delete their policy?”They lose the access that policy gave them. Give them another policy before you delete it. See Delete a policy.
Who can see the Policies tab?
Section titled “Who can see the Policies tab?”The Owner, an Admin, a Project Manager, and a Project Lead. The tab is hidden from Members.
Invitations
Section titled “Invitations”What if an invitation expires?
Section titled “What if an invitation expires?”Its status on Invited users changes to Expired. Select Resend invitation to send a new link. See Send an invitation again.
Can I invite an email address twice?
Section titled “Can I invite an email address twice?”No. TIR refuses an address that already has an invitation, or that already belongs to a person in the account. Resend the existing invitation, or give the existing person more projects with Update access.
Where does an invited person find the invitation?
Section titled “Where does an invited person find the invitation?”In TIR, under Show my invitations in the account menu at the top right. A person who is new to E2E registers from the email first. See What the invited person does.
Can one person work in several accounts?
Section titled “Can one person work in several accounts?”Yes. A person invited to your account who also has an account of their own switches between the two under Switch account in the account menu at the top right.
Removing people
Section titled “Removing people”Does deleting a user in TIR remove them from MyAccount?
Section titled “Does deleting a user in TIR remove them from MyAccount?”No. It removes them from TIR only. Deleting them in MyAccount removes them from both. See Remove a person.
Do a removed person’s SSH keys stay on my resources?
Section titled “Do a removed person’s SSH keys stay on my resources?”Yes. SSH keys a person attached to your resources stay on them when you remove the person from the account or from a project. Remove the keys from each resource yourself.
What happens when I delete a project?
Section titled “What happens when I delete a project?”Every resource in the project is permanently deleted, in every region. See Update or delete a project.
Teams and audit logs
Section titled “Teams and audit logs”Can I manage teams?
Section titled “Can I manage teams?”No. Projects sit directly under your account, and you manage access in each project. See Access without teams.
Where are Audit Logs, and can I export them?
Section titled “Where are Audit Logs, and can I export them?”Audit Logs is in the account menu at the top right. Filter by service and interval, then select Export as CSV to download the list. See View Audit Logs.