User Privileges on vSphere

This appendix contains the following topic:

User Privileges on vSphere

The following table provides the minimal set of privileges that are required by the vSphere user to execute the relevant operations in vCenter.

Roles

Privileges

Entities

Propagate to Children

ccp-vcenter

Extension.Register

Extension.Unregister

Extension.Update

StorageProfile.View

System.Anonymous

System.Read

System.View

vCenter

No

ccp-datacenter

Datastore.AllocateSpace

Datastore.FileManagement

Network.Assign

Resource.AssignVMToPool

StorageProfile.View

System.Anonymous

System.Read

System.View

VApp.ApplicationConfig

VApp.Import

VApp.InstanceConfig

VApp.ManagedByConfig

VApp.PowerOff

VApp.PowerOn

VApp.ResourceConfig

VApp.Suspend

VirtualMachine.Config.AddExistingDisk

VirtualMachine.Config.AddNewDisk

VirtualMachine.Config.AddRemoveDevice

VirtualMachine.Config.AdvancedConfig

VirtualMachine.Config.CPUCount

VirtualMachine.Config.DiskExtend

VirtualMachine.Config.ManagedBy

VirtualMachine.Config.Memory

VirtualMachine.Config.RawDevice

VirtualMachine.Config.RemoveDisk

VirtualMachine.Config.Rename

VirtualMachine.Config.Resource

VirtualMachine.Config.Settings

VirtualMachine.Interact.PowerOff

VirtualMachine.Interact.PowerOn

VirtualMachine.Inventory.Create

VirtualMachine.Inventory.CreateFromExisting

VirtualMachine.Inventory.Delete

VirtualMachine.Provisioning.Clone

VirtualMachine.Provisioning.CreateTemplateFromVM

VirtualMachine.Provisioning.DeployTemplate

Datastore

Yes

For more information on adding a provider profile, see Adding vSphere Provider Profile.

Erase User Data

You need to erase user data and return a cluster to a clean state when its physical media is replaced or removed. When working with Virtual Volumes, deleting or overwriting a file is not adequate for completely erasing user data. File systems do not overwrite the disk blocks that contain data. This means that deletion of a VM or datastore does not erase user data. In order to securely erase user data, you need to erase the physical storage underlying the datastore.

For more information on securely erasing user data from a cluster, refer to the latest documentation from your storage vendor.