Key Manager
The Key Manager manages the KMS or HSM integration that secret providers draw their key material from, including rotation and revocation. It runs no backup and no restore.
This role is coming soon. It grants no access in any family today, so assigning it has no effect yet.
Rotation and revocation are not yet capabilities the permission model can express, so there is no permission for this role to hold. It is named ahead of them rather than approximated with the permissions that exist today.
That is also what keeps it separate from the Secrets Admin. The Secrets Admin defines the secret providers, while the Key Manager manages the keys behind them. Granting it secret providers in full in the meantime would make it a second Secrets Admin rather than a distinct role.
Organization
| Permission | Access |
|---|---|
| Organization | No access |
| Members | No access |
| Audit log | No access |
| Data residency | No access |
| Restore points legal holds | No access |
| Inventory resources legal holds | No access |
Resources
| Permission | Access |
|---|---|
| Inventories | No access |
| Apps | No access |
| Restore point data | No access |
| Secret Providers | No access |
| Integrations | No access |
| Policies | No access |
| Settings | No access |
| Edges | No access |
| Configuration bundles | No access |
| Data classes | No access |
| Environments | No access |
| Schedules | No access |
Deployment
| Permission | Access |
|---|---|
| Control plane | No access |
| License | No access |