To view your own user roles across all of your accounts, go to Settings > User > Info. Remember, user roles are account-specific. The following is a list of RightScale User Roles:


Administrative control of the RightScale Account. An account can have multiple users with 'admin' privileges. Only 'admins' can send and receive account invitations. Only an 'admin' can add/change public/private cloud infrastructures and credentials, modify user permissions, and accept account group invitations on behalf of a RightScale account. The RightScale account owner (the person who created the account) cannot have admin privileges revoked by another 'admin' user; the account owner will always have 'admin' user role privileges in the account he/she created. However, only an 'admin' user can revoke another user's 'admin' privileges. Ability to view and generate Infrastructure Audit Reports. View Customer Usage Reports (if the RightScale account is enabled for this feature).


Ability to manage all cloud related activity. You need 'actor' privileges in order to act on resources and services at the cloud infrastructure level such as launch/terminate servers, create volumes and snapshots, and run scripts on running servers. You will also need this permission to create and manage deployments and server arrays. Note: The ability to create security groups and related firewall rules requires the 'security_manager' user role.


Ability to view the RightScale account. If users do not have at least 'observer' role privileges, they will not be able to log into the Dashboard and view the account in Cloud Management.


Ability to create RightScale-specific components such as ServerTemplates, RightScripts, MultiCloud Images, Repositories, Credentials, and Alert Escalations. You will need this permission to essentially perform actions underneath the Design menu of the Dashboard. With this permission you can also browse the MultiCloud Marketplace (MCM) (from within the RightScale Dashboard) for ServerTemplates and RightScripts, but you will need the 'library' user role in order to import an object from the MCM. Note: You can also view publicly-viewable assets in the MCM using


Ability to import objects from the MultiCloud Marketplace into a RightScale account. The ability to view the MultiCloud Marketplace (while logged into the RightScale dashboard) requires the 'designer' role.


Ability to manage network and firewall permissions that are used by instances in the cloud. You will need this permission in order to create security groups and define individual firewall rules within those security groups. You will also need this permission in order to create Virtual Private Clouds (VPCs) and subnets. Only trusted users should be granted this permission. You will also be able to view and generate Infrastructure Audit Reports.


Ability to log into running servers. For Linux servers running RightLink10, you can SSH into the instance using your default or custom login name. For Linux servers running RightLink prior to Rightlink10, you are identified by the first part of the email address used to log into the RightScale Dashboard. For Windows servers you can create a Remote Desktop Connection using RDP. Your managed SSH Key is used for authentication purposes. In order to establish a remote connection you must also make sure that the running instance has the appropriate firewall permissions to allow SSH (TCP port 22) and RDP (TCP port 3389) connections. See What is Server Login Control?


Ability to execute 'sudo' on running servers. (Applies to Linux-based (not Windows) servers only.) Similar to the 'security_manager' role, only trusted users should be granted this permission. Note: You will still need 'server_login' privileges in order to start an SSH/RDP session.


Ability to create sharing groups and share RightScale objects (ServerTemplates, RightScripts, and Macros) with other users. If you have a RightScale partner account, you can publish RightScale objects so that they appear in the MultiCloud Marketplace.


(Enterprise only) Manages all accounts within the enterprise. Send account invitations and grant user role privileges across all accounts in the enterprise. The master enterprise account must have at least one 'enterprise_manager' user. An 'enterprise_manager' can also grant the same privileges to another user. See Enterprise.

Note : To enable the 'enterprise_manager' role, someone that is already an 'enterprise_manager' needs to be enable the role. This is done by going to Settings > Enterprise > User in the Enterprise master account.


By default, each RightScale account is configured so that any user (with 'observer' user role privileges) can view billing related information such as estimated cloud usage costs. For example, users will be able to see detailed billing information in the RightScale Cloud Analytics site. This type of information is especially useful for users who are actively launching and managing servers for a deployment to keep track of their estimated infrastructure costs in order to stay within the allotted budget. However, if billing related information should only be viewable for select users, such as Project Managers and not Software Engineers, Enable the Admin-only Billing preference for the account, which will only allow users with 'admin' or 'billing' user role privileges to view billing related information. Note: Only users with 'admin' user role privileges can change the billing setting for the account.


The ss_end_user role grants a user End User privileges in Self-Service only, not allowing any access to Cloud Management or Cloud Analytics. This role is mutually exclusive with all Cloud Management roles -- a user can either have ss_end_user or can have any number of other roles. If a user requires any access to Cloud Management, use the actor role to grant End User privileges in Self-Service (this will also grant privileges in Cloud Management).

Note: Today, ss_end_user role can only be set explicitly by using the catalog/end_users resource in the Self-Service API and in Admin -> End Users in the Self-Service UI. This role is not visible in Cloud Management and users that have this role will not be displayed anywhere other than in Self-Service.

See also